CVE-2023-24593
Updated glib2.0 packages fix security vulnerability
Rejected by upstream.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
OSV Score usedOESA-2023-1206
glib2 security update
GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.
Security Fix(es):
glib: DoS caused by malicious serialised variant(CVE-2023-25180)
glib: DoS caused by handling a malicious text-form variant(CVE-2023-24593)
- Record
OESA-2023-1206- CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
CVE List No score
Rejected by upstream.
- Record
CVE-2023-24593- Updated
- 2026-11-02
EUVDEUVD-2023-28608 No score
Rejected by upstream.
- Record
EUVD-2023-28608- Updated
- 2026-11-03
NVD No score
Rejected reason: Rejected by upstream.
- Record
CVE-2023-24593- Updated
- 2026-11-02
OSVMGASA-2023-0176 No score
Updated glib2.0 packages fix security vulnerability
Denial of service caused by handling a malicious text-form variant. (CVE-2023-24593) Denial of service caused by malicious serialised variant. (CVE-2023-25180)
- Record
MGASA-2023-0176- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13496-1 No score
gio-branding-upstream-2.78.3-1.1 on GA media
These are all security issues fixed in the gio-branding-upstream-2.78.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13496-1- Updated
- 2026-11-02
Show 5 moreShow less
OSVSUSE-SU-2023:1910-1 No score
Security update for glib2
This update for glib2 fixes the following issues:
- CVE-2023-24593: Fixed a denial of service caused by handling a malicious text-form variant (bsc#1209714).
- CVE-2023-25180: Fixed a denial of service caused by malicious serialised variant (bsc#1209713).
- Record
SUSE-SU-2023:1910-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2060-1 No score
Security update for glib2
This update for glib2 fixes the following issues:
- CVE-2023-24593: Fixed a denial of service caused by handling a malicious text-form variant (bsc#1209714).
- CVE-2023-25180: Fixed a denial of service caused by malicious serialised variant (bsc#1209713).
The following non-security bug was fixed:
- Fixed regression on s390x (bsc#1210135, glgo#GNOME/glib!2978).
- Record
SUSE-SU-2023:2060-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2076-1 No score
Security update for glib2
This update for glib2 fixes the following issues:
- CVE-2023-24593: Fixed a denial of service caused by handling a malicious text-form variant (bsc#1209714).
- CVE-2023-25180: Fixed a denial of service caused by malicious serialised variant (bsc#1209713).
The following non-security bug was fixed:
- Fixed regression on s390x (bsc#1210135, glgo#GNOME/glib!2978).
- Record
SUSE-SU-2023:2076-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-24593 No score
Rejected reason: Rejected by upstream.
- Record
UBUNTU-CVE-2023-24593- Updated
- 2026-11-02
OSVUSN-6165-1 No score
glib2.0 vulnerabilities
It was discovered that GLib incorrectly handled non-normal GVariants. An attacker could use this issue to cause GLib to crash, resulting in a denial of service, or perform other unknown attacks.
- Record
USN-6165-1- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glib2.0Mageia:8 From an advisory covering 2 CVEs |
before 2.66.8-1.1.mga8 | 2.66.8-1.1.mga8 |
glib2openEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.66.8-11.oe1 | 2.66.8-11.oe1 |
glib2openEuler:20.03-LTS-SP3 From an advisory covering 2 CVEs |
before 2.66.8-12.oe1 | 2.66.8-12.oe1 |
glib2openEuler:22.03-LTS From an advisory covering 2 CVEs |
before 2.72.2-10.oe2203sp1 | 2.72.2-10.oe2203sp1 |
glib2openEuler:22.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.72.2-10.oe2203sp1 | 2.72.2-10.oe2203sp1 |
glib2SUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 2.48.2-12.31.1 | 2.48.2-12.31.1 |
glib2SUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 2.48.2-12.31.1 | 2.48.2-12.31.1 |
glib2SUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 2.48.2-12.31.1 | 2.48.2-12.31.1 |
glib2SUSE:Linux Enterprise Workstation Extension 12 SP5 From an advisory covering 2 CVEs |
before 2.48.2-12.31.1 | 2.48.2-12.31.1 |
glib2SUSE:Linux Enterprise Micro 5.3 From an advisory covering 2 CVEs |
before 2.70.5-150400.3.8.1 | 2.70.5-150400.3.8.1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
glib2SUSE:Linux Enterprise Micro 5.4 From an advisory covering 2 CVEs |
before 2.70.5-150400.3.8.1 | 2.70.5-150400.3.8.1 |
glib2SUSE:Linux Enterprise Module for Basesystem 15 SP4 From an advisory covering 2 CVEs |
before 2.70.5-150400.3.8.1 | 2.70.5-150400.3.8.1 |
glib2openSUSE:Leap Micro 5.3 From an advisory covering 2 CVEs |
before 2.70.5-150400.3.8.1 | 2.70.5-150400.3.8.1 |
glib2openSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 2.70.5-150400.3.8.1 | 2.70.5-150400.3.8.1 |
glib2SUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 2 CVEs |
before 2.62.6-150200.3.15.1 | 2.62.6-150200.3.15.1 |
glib2SUSE:Linux Enterprise Micro 5.1 From an advisory covering 2 CVEs |
before 2.62.6-150200.3.15.1 | 2.62.6-150200.3.15.1 |
glib2SUSE:Linux Enterprise Micro 5.2 From an advisory covering 2 CVEs |
before 2.62.6-150200.3.15.1 | 2.62.6-150200.3.15.1 |
glib2openSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 2.62.6-150200.3.15.1 | 2.62.6-150200.3.15.1 |
glib2.0Ubuntu:20.04:LTS |
before 2.64.6-1~ubuntu20.04.6, plus listed versions 2.62.1-12.63.1-22.63.1-2ubuntu12.63.3-12.63.3-3 Show 9 moreShow less2.63.5-22.64.0-12.64.1-12.64.2-1~fakesync12.64.3-1~ubuntu20.04.12.64.6-1~ubuntu20.04.12.64.6-1~ubuntu20.04.22.64.6-1~ubuntu20.04.32.64.6-1~ubuntu20.04.4 |
2.64.6-1~ubuntu20.04.6 |
glib2.0Ubuntu:22.04:LTS |
before 2.72.4-0ubuntu2.2, plus listed versions 2.68.4-1ubuntu12.70.1-12.70.2-12.71.0-22.71.1-1 Show 6 moreShow less2.71.2-12.71.3-12.72.0-12.72.1-12.72.4-0ubuntu12.72.4-0ubuntu2 |
2.72.4-0ubuntu2.2 |
glib2.0Ubuntu:20.04:LTS From an advisory covering 7 CVEs |
before 2.64.6-1~ubuntu20.04.6, plus listed versions 2.62.1-12.63.1-22.63.1-2ubuntu12.63.3-12.63.3-3 Show 9 moreShow less2.63.5-22.64.0-12.64.1-12.64.2-1~fakesync12.64.3-1~ubuntu20.04.12.64.6-1~ubuntu20.04.12.64.6-1~ubuntu20.04.22.64.6-1~ubuntu20.04.32.64.6-1~ubuntu20.04.4 |
2.64.6-1~ubuntu20.04.6 |
glib2.0Ubuntu:22.04:LTS From an advisory covering 7 CVEs |
before 2.72.4-0ubuntu2.2, plus listed versions 2.68.4-1ubuntu12.70.1-12.70.2-12.71.0-22.71.1-1 Show 6 moreShow less2.71.2-12.71.3-12.72.0-12.72.1-12.72.4-0ubuntu12.72.4-0ubuntu2 |
2.72.4-0ubuntu2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-24593 has been rejected by its source and should not be treated as a live vulnerability, published March 29, 2023. Fixed in glib2.0 2.64.6-1~ubuntu20.04.6.
References
advisories.mageia.org/MGASA-2023-0176.html
bugs.mageia.org/show_bug.cgi?id=31805
lists.fedoraproject.org/archives/list/[email protected]/thread/FRPEEZJKIVRRCTBOO42O6IY44O5UU3MT
lists.suse.com/pipermail/sle-security-updates/2023-April/014499.html
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1206
nvd.nist.gov/vuln/detail/CVE-2023-25180
Show 20 moreShow less
suse.com/support/update/announcement/2023/suse-su-20231910-1
bugzilla.suse.com/1209713
ubuntu.com/security/CVE-2023-24593
access.redhat.com/security/cve/CVE-2023-24593
discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
cve.org/CVERecord?id=CVE-2023-24593