ALAS-2025-2767

Amazon Linux 2 Security Advisory: ALAS-2025-2767
Advisory Release Date: 2025-02-12 23:17 Pacific
Advisory Updated Date: 2025-02-25 10:30 Pacific
Severity: Important
Issue Overview:

GLib's GVariant deserialization prior to GLib 2.74.4 failed to validate the input conforms to the expected format, leading to denial of service. (CVE-2023-29499)

GLib's GVariant deserialization prior to GLib 2.74.4 is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service. (CVE-2023-32611)

GLib's GVariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-29499 (CVE-2023-32636)

GLib's GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665. (CVE-2023-32643)

GLib's GVariant deserialization prior to GLib 2.74.4 is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service. (CVE-2023-32665)


Affected Packages:

glib2


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update glib2 to update your system.

New Packages:
aarch64:
    glib2-2.56.1-9.amzn2.0.9.aarch64
    glib2-devel-2.56.1-9.amzn2.0.9.aarch64
    glib2-fam-2.56.1-9.amzn2.0.9.aarch64
    glib2-static-2.56.1-9.amzn2.0.9.aarch64
    glib2-tests-2.56.1-9.amzn2.0.9.aarch64
    glib2-debuginfo-2.56.1-9.amzn2.0.9.aarch64

i686:
    glib2-2.56.1-9.amzn2.0.9.i686
    glib2-devel-2.56.1-9.amzn2.0.9.i686
    glib2-fam-2.56.1-9.amzn2.0.9.i686
    glib2-static-2.56.1-9.amzn2.0.9.i686
    glib2-tests-2.56.1-9.amzn2.0.9.i686
    glib2-debuginfo-2.56.1-9.amzn2.0.9.i686

noarch:
    glib2-doc-2.56.1-9.amzn2.0.9.noarch

src:
    glib2-2.56.1-9.amzn2.0.9.src

x86_64:
    glib2-2.56.1-9.amzn2.0.9.x86_64
    glib2-devel-2.56.1-9.amzn2.0.9.x86_64
    glib2-fam-2.56.1-9.amzn2.0.9.x86_64
    glib2-static-2.56.1-9.amzn2.0.9.x86_64
    glib2-tests-2.56.1-9.amzn2.0.9.x86_64
    glib2-debuginfo-2.56.1-9.amzn2.0.9.x86_64

Additional References

Red Hat: CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665

Mitre: CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643, CVE-2023-32665