Every CVE Search/ Get API key

CVE-2020-6750

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address...

5.9 MediumFix available

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

2.20%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
CVE-2020-6750
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Updated
2026-11-02
CVE List No score

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
CVE-2020-6750
Updated
2026-11-02
EUVDEUVD-2020-27897 No score

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
EUVD-2020-27897
Updated
2026-11-03
GitHub AdvisoriesGHSA-w778-hx63-vw7w No score

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address...

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
GHSA-w778-hx63-vw7w
Weakness
CWE-200
Updated
2026-11-02
OSVALPINE-CVE-2020-6750 5.9

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
ALPINE-CVE-2020-6750
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVAZL-6436 5.9

CVE-2020-6750 affecting package glib for versions less than 2.71.0-1

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
AZL-6436
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVBELL-CVE-2020-6750 5.9

CVE-2020-6750 does not affect BellSoft software

Record
BELL-CVE-2020-6750
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSV 5.9

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
CVE-2020-6750
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-6750 5.9

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
DEBIAN-CVE-2020-6750
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-6750 5.9

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected.

Record
UBUNTU-CVE-2020-6750
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2020-0118 No score

Updated glib2.0 packages fix security vulnerability

The updated packages fix a security vulnerability:

GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. (CVE-2020-6750)

Record
MGASA-2020-0118
Updated
2026-11-02
OSVopenSUSE-SU-2024:10791-1 No score

gio-branding-upstream-2.68.4-2.2 on GA media

These are all security issues fixed in the gio-branding-upstream-2.68.4-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10791-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glib
Alpine:v3.11
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.12
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.13
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.14
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.15
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.16
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.17
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.18
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.19
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.20
 2.60.0 up to 2.62.5-r0
2.62.5-r0
Show 9 moreShow less
Affected packages
PackageAffectedFixed
glib
Alpine:v3.21
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.22
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.23
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Alpine:v3.24
 2.60.0 up to 2.62.5-r0
2.62.5-r0
glib
Azure Linux:2
 before 2.71.0-1
2.71.0-1
glib2.0
Debian:12
 before 2.62.5-1
2.62.5-1
glib2.0
Debian:13
 before 2.62.5-1
2.62.5-1
glib2.0
Debian:14
 before 2.62.5-1
2.62.5-1
glib2.0
Mageia:7
 before 2.60.2-1.3.mga7
2.60.2-1.3.mga7

History

History
RecordedChangedSources
facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-6750 is a medium vulnerability (CVSS 5.9) in Gnome Glib, published January 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.20%, the 82nd percentile. Fixed in glib 2.62.5-r0.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open