CVE-2025-13601
EUVD-2025-19972026.11.2025, 15:15
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | codeready_linux_builder | 9.0 |
| redhat | codeready_linux_builder_for_ibm_z_systems | 9.0_s390x:_s390x |
| redhat | codeready_linux_builder_for_power_little_endian | 9.0_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_x86_64 | 9.0 |
| redhat | enterprise_linux_for_arm_64 | 9.0 |
| redhat | enterprise_linux_for_ibm_z_systems | 9.0_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 9.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_x86_64 | 9.0 |
| redhat | codeready_linux_builder_for_arm64 | 10.0 |
| redhat | codeready_linux_builder_for_ibm_z_systems | 10.0_s390x:_s390x |
| redhat | codeready_linux_builder_for_power_little_endian | 10.0_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_x86_64 | 10.0 |
| redhat | enterprise_linux_for_arm_64 | 10.0 |
| redhat | enterprise_linux_for_ibm_z_systems | 10.0_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 10.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_x86_64 | 10.0 |
| redhat | codeready_linux_builder_for_arm64 | 8.0 |
| redhat | codeready_linux_builder_for_ibm_z_systems | 8.0_s390x:_s390x |
| redhat | codeready_linux_builder_for_power_little_endian | 8.0_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_x86_64 | 8.0 |
| redhat | enterprise_linux_for_arm_64 | 8.0 |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 8.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_x86_64 | 8.0 |
| redhat | enterprise_linux_for_arm_64 | 9.2 |
| redhat | enterprise_linux_for_ibm_z_systems | 9.2_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 9.2_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_x86_64 | 9.2 |
| redhat | enterprise_linux_server_aus | 9.2 |
| redhat | codeready_linux_builder_for_arm64_eus | 9.4 |
| redhat | codeready_linux_builder_for_ibm_z_systems | 9.4_s390x:_s390x |
| redhat | codeready_linux_builder_for_power_little_endian | 9.4_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_x86_64 | 9.4 |
| redhat | enterprise_linux_for_arm_64 | 9.4 |
| redhat | enterprise_linux_for_ibm_z_systems | 9.4_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 9.4_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_x86_64 | 9.4 |
| redhat | enterprise_linux_for_x86_64_eus | 9.4 |
| redhat | enterprise_linux_server_aus | 9.4 |
| redhat | enterprise_linux_server_for_power_little_endian | 9.4_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_for_power_little_endian_eus | 9.4_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_arm64_eus | 10.0 |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | 10.0_s390x:_s390x |
| redhat | codeready_linux_builder_for_power_little_endian_eus | 10.0_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_x86_64_eus | 10.0 |
| redhat | enterprise_linux_for_arm_64_eus | 10.0 |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 10.0_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian_eus | 10.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_x86_64_eus | 10.0 |
| redhat | enterprise_linux_server_for_power_little_endian | 10.0_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_arm64 | 9.6 |
| redhat | codeready_linux_builder_for_ibm_z_systems | 9.6_s390x:_s390x |
| redhat | codeready_linux_builder_for_power_little_endian | 9.6_ppc64le:_ppc64le |
| redhat | codeready_linux_builder_for_x86_64 | 9.6 |
| redhat | enterprise_linux_for_arm_64 | 9.6 |
| redhat | enterprise_linux_for_ibm_z_systems | 9.6_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 9.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_x86_64 | 9.6 |
| redhat | enterprise_linux_for_x86_64_eus | 9.6 |
| redhat | enterprise_linux_server_aus | 9.6 |
| redhat | enterprise_linux_server_for_power_little_endian | 9.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_x86_64 | 8.6 |
| redhat | enterprise_linux_for_x86_64_eus | 8.6 |
| redhat | enterprise_linux_server_aus | 8.6 |
| redhat | enterprise_linux_server_for_power_little_endian | 8.6_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_tus | 8.6 |
| redhat | enterprise_linux_for_x86_64 | 8.8 |
| redhat | enterprise_linux_for_x86_64_eus | 8.8 |
| redhat | enterprise_linux_server_for_power_little_endian | 8.8_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_tus | 8.8 |
| redhat | enterprise_linux_for_x86_64_eus | 8.4 |
| redhat | enterprise_linux_server_aus | 8.4 |
| redhat | enterprise_linux_server_aus | 8.2 |
| redhat | ceph_storage | 8.0 |
| redhat | discovery | 2.0 |
| gnome | glib | 𝑥 < 2.86.3 |
| redhat | openshift_container_platform | 4.12 |
| redhat | openshift_container_platform | 4.16 |
| redhat | openshift_container_platform | 4.17 |
| redhat | openshift_container_platform | 4.18 |
| redhat | openshift_container_platform | 4.19 |
| redhat | openshift_container_platform_for_arm64 | 4.12 |
| redhat | openshift_container_platform_for_arm64 | 4.16 |
| redhat | openshift_container_platform_for_arm64 | 4.17 |
| redhat | openshift_container_platform_for_arm64 | 4.18 |
| redhat | openshift_container_platform_for_arm64 | 4.19 |
| redhat | openshift_container_platform_for_ibm_z | 4.12 |
| redhat | openshift_container_platform_for_ibm_z | 4.16 |
| redhat | openshift_container_platform_for_ibm_z | 4.17 |
| redhat | openshift_container_platform_for_ibm_z | 4.18 |
| redhat | openshift_container_platform_for_ibm_z | 4.19 |
| redhat | openshift_container_platform_for_linuxone | 4.12 |
| redhat | openshift_container_platform_for_linuxone | 4.16 |
| redhat | openshift_container_platform_for_linuxone | 4.17 |
| redhat | openshift_container_platform_for_linuxone | 4.18 |
| redhat | openshift_container_platform_for_linuxone | 4.19 |
| redhat | openshift_container_platform_for_power | 4.12 |
| redhat | openshift_container_platform_for_power | 4.16 |
| redhat | openshift_container_platform_for_power | 4.17 |
| redhat | openshift_container_platform_for_power | 4.18 |
| redhat | openshift_container_platform_for_power | 4.19 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Siemens | RUGGEDCOM RST2428P | 𝑥 < V4.0 | ADP |
Ubuntu Releases
Ubuntu Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| glib2.0 |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| glib2-devel |
| ||||||||||||||||||||||||
| glib2-devel-static |
| ||||||||||||||||||||||||
| glib2-lang |
| ||||||||||||||||||||||||
| glib2-tools |
| ||||||||||||||||||||||||
| libgio-2_0-0 |
| ||||||||||||||||||||||||
| libgio-2_0-0-32bit |
| ||||||||||||||||||||||||
| libglib-2_0-0 |
| ||||||||||||||||||||||||
| libglib-2_0-0-32bit |
| ||||||||||||||||||||||||
| libgmodule-2_0-0 |
| ||||||||||||||||||||||||
| libgmodule-2_0-0-32bit |
| ||||||||||||||||||||||||
| libgobject-2_0-0 |
| ||||||||||||||||||||||||
| libgobject-2_0-0-32bit |
| ||||||||||||||||||||||||
| libgthread-2_0-0 |
| ||||||||||||||||||||||||
| libgthread-2_0-0-32bit |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| glib2 |
| ||||||||||||||||||
| glib2-devel |
| ||||||||||||||||||
| glib2-doc |
| ||||||||||||||||||
| glib2-fam |
| ||||||||||||||||||
| glib2-static |
| ||||||||||||||||||
| glib2-tests |
| ||||||||||||||||||
| mingw32-glib2 |
| ||||||||||||||||||
| mingw32-glib2-static |
| ||||||||||||||||||
| mingw64-glib2 |
| ||||||||||||||||||
| mingw64-glib2-static |
|
References