Debian Security Advisory

DLA-3044-1 glib2.0 -- LTS security update

Date Reported:
06 Jun 2022
Affected Packages:
glib2.0
Vulnerable:
Yes
Security database references:
In the Debian bugtracking system: Bug 984969, Bug 982778, Bug 982779.
In Mitre's CVE dictionary: CVE-2021-27218, CVE-2021-27219, CVE-2021-28153.
More information:

Several security vulnerabilities were found in glib2.0, a general-purpose utility library for the GNOME environment.

  • CVE-2021-27218

    If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation.

  • CVE-2021-27219

    The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption.

  • CVE-2021-28153

    When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

    For Debian 9 stretch, these problems have been fixed in version 2.50.3-2+deb9u3.

    We recommend that you upgrade your glib2.0 packages.

    For the detailed security status of glib2.0 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/glib2.0

    Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS