CVE-2023-32636

NameCVE-2023-32636
DescriptionA flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
glib2.0 (PTS)bullseye2.66.8-1+deb11u4fixed
bullseye (security)2.66.8-1+deb11u5fixed
bookworm2.74.6-2+deb12u4fixed
bookworm (security)2.74.6-2+deb12u2fixed
sid, trixie2.82.2-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
glib2.0source(unstable)(not affected)

Notes

- glib2.0 <not-affected> (Incomplete fixes for CVE-2023-29499, CVE-2023-32611 and CVE-2023-32665 not applied)
https://gitlab.gnome.org/GNOME/glib/-/issues/2841

Search for package or bug name: Reporting problems