CVE-2023-29499

A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
gnomeglib
𝑥
< 2.74.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
glib2.0
bookworm
2.74.6-2+deb12u4
fixed
bookworm (security)
2.74.6-2+deb12u2
fixed
bullseye
2.66.8-1+deb11u4
fixed
bullseye (security)
2.66.8-1+deb11u5
fixed
sid
2.82.4-1
fixed
trixie
2.82.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
glib2.0
bionic
Fixed 2.56.4-0ubuntu0.18.04.9+esm3
released
focal
Fixed 2.64.6-1~ubuntu20.04.6
released
jammy
Fixed 2.72.4-0ubuntu2.2
released
kinetic
Fixed 2.74.3-0ubuntu1.2
released
lunar
not-affected
mantic
not-affected
trusty
Fixed 2.40.2-0ubuntu1.1+esm6
released
xenial
Fixed 2.48.2-0ubuntu4.8+esm3
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
glib2-devel
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
glib2-lang
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
glib2-tools
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libgio-2_0-0
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libgio-2_0-0-32bit
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libglib-2_0-0
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libglib-2_0-0-32bit
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libgmodule-2_0-0
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libgmodule-2_0-0-32bit
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libgobject-2_0-0
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libgobject-2_0-0-32bit
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
libgthread-2_0-0
suse enterprise server 15 SP1
2.54.3-150000.4.29.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
glib2
RHEL 9
0:2.68.4-11.el9
fixed
glib2-devel
RHEL 9
0:2.68.4-11.el9
fixed
glib2-doc
RHEL 9
0:2.68.4-11.el9
fixed
glib2-static
RHEL 9
0:2.68.4-11.el9
fixed
glib2-tests
RHEL 9
0:2.68.4-11.el9
fixed
mingw32-glib2
RHEL 9
0:2.78.0-1.el9
fixed
mingw32-glib2-static
RHEL 9
0:2.78.0-1.el9
fixed
mingw64-glib2
RHEL 9
0:2.78.0-1.el9
fixed
mingw64-glib2-static
RHEL 9
0:2.78.0-1.el9
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2023-29499
https://bugzilla.redhat.com/show_bug.cgi?id=2211828
https://gitlab.gnome.org/GNOME/glib/-/issues/2794
https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html
https://security.gentoo.org/glsa/202311-18
https://security.netapp.com/advisory/ntap-20231103-0001/
https://access.redhat.com/security/cve/CVE-2023-29499
https://bugzilla.redhat.com/show_bug.cgi?id=2211828
https://gitlab.gnome.org/GNOME/glib/-/issues/2794
https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html
https://security.gentoo.org/glsa/202311-18
https://security.netapp.com/advisory/ntap-20231103-0001/