CVE-2024-52533

NameCVE-2024-52533
Descriptiongio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3962-1
Debian Bugs1087419

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
glib2.0 (PTS)bullseye2.66.8-1+deb11u4vulnerable
bullseye (security)2.66.8-1+deb11u5fixed
bookworm2.74.6-2+deb12u4vulnerable
bookworm (security)2.74.6-2+deb12u2vulnerable
sid, trixie2.82.3-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
glib2.0sourcebullseye2.66.8-1+deb11u5DLA-3962-1
glib2.0source(unstable)2.82.1-11087419

Notes

[bookworm] - glib2.0 <no-dsa> (Minor issue)
https://gitlab.gnome.org/GNOME/glib/-/issues/3461
https://gitlab.gnome.org/GNOME/glib/-/commit/25833cefda24c60af913d6f2d532b5afd608b821 (main)
https://gitlab.gnome.org/GNOME/glib/-/commit/ec0b708b981af77fef8e4bbb603cde4de4cd2e29 (2.82.1)

Search for package or bug name: Reporting problems