Univention Bugzilla – Bug 53477
glib2.0: Multiple issues (5.0)
Last modified: 2021-06-30 18:54:28 CEST
New Debian glib2.0 2.58.3-2+deb10u3 fixes: This update addresses the following issues: * integer overflow in g_byte_array_new_take function when called with a buffer of 4GB or more on a 64-bit platform (CVE-2021-27218) * integer overflow in g_bytes_new function on 64-bit platforms due to an implicit cast from 64 bits to 32 bits (CVE-2021-27219) * g_file_replace() with G_FILE_CREATE_REPLACE_DESTINATION creates empty target for dangling symlink (CVE-2021-28153)
--- mirror/ftp/pool/main/g/glib2.0/glib2.0_2.58.3-2+deb10u2.dsc +++ apt/ucs_5.0-0-errata5.0-0/source/glib2.0_2.58.3-2+deb10u3.dsc @@ -1,3 +1,21 @@ +2.58.3-2+deb10u3 [Sat, 27 Mar 2021 11:34:13 +0000] Simon McVittie <smcv@debian.org>: + + * d/patches: Resolve integer overflows, including CVE-2021-27219. + These backported patches resolve an integer overflow that is known to + be attacker-triggerable for denial of service in polkit (policykit-1), + as well as replacing other simple uses of g_memdup() with g_memdup2(). + Overflows in most of these places would not be attacker-triggerable, + but replacing them is simpler than assessing whether they are + attacker-triggerable. + The more complicated changes from 2.66.7 have not been backported, + to avoid regressions in Debian 10; overflows in those locations are + not believed to be attacker-triggerable. (Closes: #982778) + * d/patches: Fix integer overflow CVE-2021-27218. + This is not known to be exploitable in any particular program, but + might be. (Closes: #982779) + * d/patches: Fix a symlink attack affecting file-roller, CVE-2021-28153 + (Closes: #984969) + 2.58.3-2+deb10u2 [Wed, 06 Nov 2019 08:29:15 +0000] Simon McVittie <smcv@debian.org>: * Team upload <http://piuparts.knut.univention.de/5.0-0/#314808000010685060>
OK: yaml OK: announce_errata OK: patch OK: piuparts [5.0-0] 0423d6a882 Bug #53477: glib2.0 2.58.3-2+deb10u3 doc/errata/staging/glib2.0.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
<https://errata.software-univention.de/#/?erratum=5.0x33>