Description
A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.
Problem types
Buffer Underwrite ('Buffer Underflow')
Product status
Any version before 2.84.2
0:2.80.4-4.el10_0.6 (rpm) before *
0:2.56.4-166.el8_10 (rpm) before *
0:2.56.4-8.el8_2.2 (rpm) before *
0:2.56.4-10.el8_4.2 (rpm) before *
0:2.56.4-10.el8_4.2 (rpm) before *
0:2.56.4-158.el8_6.2 (rpm) before *
0:2.56.4-158.el8_6.2 (rpm) before *
0:2.56.4-158.el8_6.2 (rpm) before *
0:2.56.4-162.el8_8 (rpm) before *
0:2.56.4-162.el8_8 (rpm) before *
0:2.68.4-16.el9_6.2 (rpm) before *
0:2.68.4-16.el9_6.2 (rpm) before *
0:2.68.4-5.el9_0.2 (rpm) before *
0:2.68.4-7.el9_2.2 (rpm) before *
0:2.68.4-14.el9_4.3 (rpm) before *
sha256:e54a5a5f9d69dd6a03e2bcd845e2202910a188d266d4a79b12c387ceffc36f2d (rpm) before *
sha256:a891aa3f77d70d9d7966dfc71ff9087f45deb95d3025072da96a3ec5220db1f3 (rpm) before *
sha256:d9ca4a9ec5bc8de23e4550387f822f19949cdfbc4aeeab20e07b206d92f4a426 (rpm) before *
sha256:addf7b49ce99777a3bbf12c2e6678b604f3cfaf91feaaeb4192d75e902e46458 (rpm) before *
sha256:d4ef54ac8de0eaf22e294dad8852ea8b5c20f85deb19629a3a4e0020851266c3 (rpm) before *
sha256:1c4617b035c66b6b34e9b19f618f72a19da5fce644d79e24eb262f14c848bc81 (rpm) before *
sha256:8c5dddd29d08fe8234edbbcda055fe6b0f9a7d7a0edfc3cd130797fdf78cce5c (rpm) before *
sha256:be3feca3b19ac609e5ef829887b6d03ca3c504163ed0f9e10b2410cdfb175b72 (rpm) before *
sha256:3d37f30462f237f5087ef8ac90e39f5cd2cbaf5c143f7cae9d6155eb574726f2 (rpm) before *
sha256:8fb68adefecd8ccb94404399ac6c8038c064c85287f4f980a0855da1cbd0dcb7 (rpm) before *
Timeline
| 2025-05-06: | Reported to Red Hat. |
| 2025-05-06: | Made public. |
References
cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.com/productcert/html/ssa-089022.html
access.redhat.com/errata/RHSA-2025:10855 (RHSA-2025:10855)
access.redhat.com/errata/RHSA-2025:11140 (RHSA-2025:11140)
access.redhat.com/errata/RHSA-2025:11327 (RHSA-2025:11327)
access.redhat.com/errata/RHSA-2025:11373 (RHSA-2025:11373)
access.redhat.com/errata/RHSA-2025:11374 (RHSA-2025:11374)
access.redhat.com/errata/RHSA-2025:11662 (RHSA-2025:11662)
access.redhat.com/errata/RHSA-2025:12275 (RHSA-2025:12275)
access.redhat.com/errata/RHSA-2025:13335 (RHSA-2025:13335)
access.redhat.com/errata/RHSA-2025:14988 (RHSA-2025:14988)
access.redhat.com/errata/RHSA-2025:14989 (RHSA-2025:14989)
access.redhat.com/errata/RHSA-2025:14990 (RHSA-2025:14990)
access.redhat.com/errata/RHSA-2025:14991 (RHSA-2025:14991)
access.redhat.com/security/cve/CVE-2025-4373
bugzilla.redhat.com/show_bug.cgi?id=2364265 (RHBZ#2364265)
gitlab.gnome.org/GNOME/glib/-/issues/3677