MGASA-2021-0123

    Dashboard / Vulnerabilities / MGASA-2021-0123

    MGASA-2021-0123

    Published: 12 Mar 2021Last Modified: 16 Apr 2026

    Summary: Updated glib2.0 packages fix security vulnerabilities

    Details: * Fix various instances within GLib where `g_memdup()` was vulnerable to a silent integer truncation and heap overflow problem (discovered by Kevin Backhouse, work by Philip Withnall) (#2319) * Fix some issues with handling over-long (invalid) input when parsing for `GDate` (!1824) * Don't load GIO modules or parse other GIO environment variables when `AT_SECURE` is set (i.e. in a setuid/setgid/setcap process). GIO has always been documented as not being safe to use in privileged processes, but people persist in using it unsafely, so these changes should harden things against potential attacks at least a little. Unfortunately they break a couple of projects which were relying on reading `DBUS_SESSION_BUS_ADDRESS`, so GIO continues to read that for setgid/setcap (but not setuid) processes. This loophole will be closed in GLib 2.70 (see issue #2316), which should give modules 6 months to change their behaviour. (Work by Simon McVittie and Philip Withnall) (#2168, #2305) * Fix `g_spawn()` searching `PATH` when it wasn't meant to (work by Simon McVittie and Thomas Haller) (!1913) Also, this update provides 2.66.7 version that fixes several issues: * Fix various regressions caused by rushed security fixes in 2.66.6 (work by Simon McVittie and Jan Alexander Steffens) (!1933, !1943) * Fix a silent integer truncation when calling `g_byte_array_new_take()` for byte arrays bigger than `G_MAXUINT` (work by Krzesimir Nowak) (!1944) * Disallow using currently-undefined D-Bus connection or server flags to prevent forward-compatibility problems with new security-sensitive flags likely to be released in GLib 2.68 (work by Simon McVittie) (!1945)

    References: https://advisories.mageia.org/MGASA-2021-0123.html, https://bugs.mageia.org/show_bug.cgi?id=28392, https://lists.fedoraproject.org/archives/list/[email protected]/thread/RKZC2OMFCXQTQDGIDS4JBWOWNQUAAOV2/, https://lists.fedoraproject.org/archives/list/[email protected]/thread/F3TX2KSXDNFQN6HBKCYRZSZWKF4W5EYJ/

    Affected packages

    Package

    Name: glib2.0

    Purl: pkg:rpm/mageia/glib2.0?arch=source&distro=mageia-8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.66.7-1.mga8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2021-0123 | CVE-DB