New Debian glib2.0 2.74.6-2+deb12u7 fixes: This update addresses the following issues: * glibc: GLib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid ISO 8601 timestamp with g_date_time_new_from_iso8601(). (CVE-2025-3360) 2.74.6-2+deb12u7 (Mon, 18 Aug 2025 09:27:51 +0100) * d/p/gstring-carefully-handle-gssize-parameters.patch, d/p/gstring-Make-len_unsigned-unsigned.patch: Add patches from upstream to fix a buffer underflow in GString. This could cause a memory overwrite if a program handles extremely large text strings of an attacker-controlled length. The required string length would be close to 2 GiB on 32-bit and the bug is not believed to be practically feasible to exploit on 64-bit. (CVE-2025-4373) * d/p/glib-gfileutils.c-use-64-bits-for-value-in-get_tmp_file.patch, d/p/gfileutils-fix-computation-of-temporary-file-name.patch: Add patches from upstream to fix a buffer underflow in get_tmp_file(). This is used in g_mkstemp(), g_mkdtemp() and similar functions, and could cause a crash or possibly arbitrary file overwrites (believed to be unlikely to be exploitable in practice) if a long-running program creates more than 2 billion temporary files. (CVE-2025-7039) * d/libglib2.0-0.postrm.in: Rewrite postrm for safer upgrade behaviour, based on the version in unstable and proposed for inclusion in trixie: - Only remove giomodule.cache during purge, not during remove. This matches the behaviour of gschemas.compiled and avoids a window between old-postrm and new-postinst during which giomodule.cache is missing, breaking applications that need GIO modules. - Don't remove gschemas.compiled or giomodule.cache during purge if there is evidence that they might still be needed , #1110696): + don't remove them if ${libdir}/glib-2.0 still exists, for example provided by libglib2.0-0t64 after upgrading to trixie; + don't remove gschemas.compiled if at least one GSettings schema still exists; + don't remove giomodule.cache if at least one GIO module still exists - Refactoring to support the above * d/tests/1065022-futureproofing: Add a test for #1065022, modified from the version in unstable and proposed for inclusion in trixie
--- mirror/ftp/pool/main/g/glib2.0/glib2.0_2.74.6-2+deb12u6.dsc +++ apt/ucs_5.2-0-errata5.2-3/source/glib2.0_2.74.6-2+deb12u7.dsc @@ -1,3 +1,41 @@ +2.74.6-2+deb12u7 [Mon, 18 Aug 2025 09:27:51 +0100] Simon McVittie <smcv@debian.org>: + + * d/p/gstring-carefully-handle-gssize-parameters.patch, + d/p/gstring-Make-len_unsigned-unsigned.patch: + Add patches from upstream to fix a buffer underflow in GString. + This could cause a memory overwrite if a program handles extremely large + text strings of an attacker-controlled length. The required string length + would be close to 2 GiB on 32-bit and the bug is not believed to be + practically feasible to exploit on 64-bit. (CVE-2025-4373) + (Closes: #1104930) + * d/p/glib-gfileutils.c-use-64-bits-for-value-in-get_tmp_file.patch, + d/p/gfileutils-fix-computation-of-temporary-file-name.patch: + Add patches from upstream to fix a buffer underflow in get_tmp_file(). + This is used in g_mkstemp(), g_mkdtemp() and similar functions, and + could cause a crash or possibly arbitrary file overwrites (believed to + be unlikely to be exploitable in practice) if a long-running program + creates more than 2 billion temporary files. (CVE-2025-7039) + (Closes: #1110640) + * d/libglib2.0-0.postrm.in: + Rewrite postrm for safer upgrade behaviour, based on the version + in unstable and proposed for inclusion in trixie: + - Only remove giomodule.cache during purge, not during remove. + This matches the behaviour of gschemas.compiled and avoids a window + between old-postrm and new-postinst during which giomodule.cache is + missing, breaking applications that need GIO modules. + - Don't remove gschemas.compiled or giomodule.cache during purge + if there is evidence that they might still be needed + (Closes: #1065022, #1110696): + + don't remove them if ${libdir}/glib-2.0 still exists, for example + provided by libglib2.0-0t64 after upgrading to trixie; + + don't remove gschemas.compiled if at least one GSettings schema + still exists; + + don't remove giomodule.cache if at least one GIO module still exists + - Refactoring to support the above + * d/tests/1065022-futureproofing: + Add a test for #1065022, modified from the version in unstable and + proposed for inclusion in trixie + 2.74.6-2+deb12u6 [Sat, 12 Apr 2025 16:52:16 +0300] Adrian Bunk <bunk@debian.org>: * Non-maintainer upload. <http://piuparts.knut.univention.de/5.2-3/#6678937148579325644>
OK: bug OK: yaml OK: announce_errata OK: patch OK: piuparts [5.2-3] cb44027399 chore(postgresql-15): update advisory doc/errata/staging/glib2.0.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) [5.2-3] cc1ba9bad3 Bug #58613: glib2.0 2.74.6-2+deb12u7 doc/errata/staging/glib2.0.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
<https://errata.software-univention.de/#/?erratum=5.2x191>