{"id":"CVE-2023-24593","aliases":["EUVD-2023-28608","MGASA-2023-0176","OESA-2023-1206","SUSE-SU-2023:1910-1","SUSE-SU-2023:2060-1","SUSE-SU-2023:2076-1","UBUNTU-CVE-2023-24593","USN-6165-1","openSUSE-SU-2024:13496-1"],"status":"rejected","title":"Updated glib2.0 packages fix security vulnerability","description":"Rejected by upstream.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-03-29T00:00:00Z","modified":"2026-08-18T01:17:38Z","fixes":[{"ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","fixed_in":["2.64.6-1~ubuntu20.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","fixed_in":["2.72.4-0ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:8","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.66.8-1.1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.66.8-11.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.66.8-12.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.2-10.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.2-10.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-12.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-12.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-12.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-12.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.5-150400.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.5-150400.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.5-150400.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.5-150400.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.70.5-150400.3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.6-150200.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.6-150200.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.6-150200.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.62.6-150200.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.64.6-1~ubuntu20.04.6"}]}],"versions":["2.62.1-1","2.63.1-2","2.63.1-2ubuntu1","2.63.3-1","2.63.3-3","2.63.5-2","2.64.0-1","2.64.1-1","2.64.2-1~fakesync1","2.64.3-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.2","2.64.6-1~ubuntu20.04.3","2.64.6-1~ubuntu20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.4-0ubuntu2.2"}]}],"versions":["2.68.4-1ubuntu1","2.70.1-1","2.70.2-1","2.71.0-2","2.71.1-1","2.71.2-1","2.71.3-1","2.72.0-1","2.72.1-1","2.72.4-0ubuntu1","2.72.4-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.64.6-1~ubuntu20.04.6"}]}],"versions":["2.62.1-1","2.63.1-2","2.63.1-2ubuntu1","2.63.3-1","2.63.3-3","2.63.5-2","2.64.0-1","2.64.1-1","2.64.2-1~fakesync1","2.64.3-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.2","2.64.6-1~ubuntu20.04.3","2.64.6-1~ubuntu20.04.4"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.4-0ubuntu2.2"}]}],"versions":["2.68.4-1ubuntu1","2.70.1-1","2.70.2-1","2.71.0-2","2.71.1-1","2.71.2-1","2.71.3-1","2.72.0-1","2.72.1-1","2.72.4-0ubuntu1","2.72.4-0ubuntu2"],"bundled":7}],"references":[{"url":"https://advisories.mageia.org/MGASA-2023-0176.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31805","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FRPEEZJKIVRRCTBOO42O6IY44O5UU3MT/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-April/014499.html","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1206","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24593","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20231910-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1209713","tags":["report"]},{"url":"https://bugzilla.suse.com/1209714","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25180","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232060-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210135","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232076-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-24593","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24593","tags":["report"]},{"url":"https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6165-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32665","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-24593","description":"Rejected by upstream.","status":"rejected","modified":"2023-07-20T20:27:34.167Z","updated_at":"2026-11-02T14:35:26.63732Z"}],"euvd":[{"id":"EUVD-2023-28608","description":"Rejected by upstream.","status":"published","modified":"2023-07-20T20:27:34Z","updated_at":"2026-11-03T03:50:56.082226Z"}],"nvd":[{"id":"CVE-2023-24593","description":"Rejected reason: Rejected by upstream.","status":"rejected","published":"2023-07-20T21:15:09.883Z","modified":"2023-11-07T04:08:34.613Z","updated_at":"2026-11-02T14:08:17.044696Z"}],"osv":[{"id":"OESA-2023-1206","title":"glib2 security update","description":"GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since.\r\n\r\nSecurity Fix(es):\r\n\r\n\nglib: DoS caused by malicious serialised variant(CVE-2023-25180)\r\n\r\n\nglib: DoS caused by handling a malicious text-form variant(CVE-2023-24593)","status":"published","published":"2023-04-11T11:05:40Z","modified":"2026-08-18T01:17:38.862377464Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"MGASA-2023-0176","title":"Updated glib2.0 packages fix security vulnerability","description":"Denial of service caused by handling a malicious text-form variant.\n(CVE-2023-24593)\nDenial of service caused by malicious serialised variant. (CVE-2023-25180)\n","status":"published","published":"2023-05-21T08:42:44Z","modified":"2026-04-16T04:42:07.030166772Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13496-1","title":"gio-branding-upstream-2.78.3-1.1 on GA media","description":"These are all security issues fixed in the gio-branding-upstream-2.78.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:26.127237Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:1910-1","title":"Security update for glib2","description":"This update for glib2 fixes the following issues:\n\n- CVE-2023-24593: Fixed a denial of service caused by handling a malicious text-form variant (bsc#1209714).\n- CVE-2023-25180: Fixed a denial of service caused by malicious serialised variant (bsc#1209713).\n","status":"published","published":"2023-04-19T09:57:31Z","modified":"2026-02-04T03:12:36.146559Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2060-1","title":"Security update for glib2","description":"This update for glib2 fixes the following issues:\n\n- CVE-2023-24593: Fixed a denial of service caused by handling a malicious text-form variant (bsc#1209714).\n- CVE-2023-25180: Fixed a denial of service caused by malicious serialised variant (bsc#1209713).\n\nThe following non-security bug was fixed:\n\n- Fixed regression on s390x (bsc#1210135, glgo#GNOME/glib!2978).\n","status":"published","published":"2023-04-27T15:04:35Z","modified":"2025-05-02T04:34:40.666588Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2076-1","title":"Security update for glib2","description":"This update for glib2 fixes the following issues:\n\n- CVE-2023-24593: Fixed a denial of service caused by handling a malicious text-form variant (bsc#1209714).\n- CVE-2023-25180: Fixed a denial of service caused by malicious serialised variant (bsc#1209713).\n\nThe following non-security bug was fixed:\n\n- Fixed regression on s390x (bsc#1210135, glgo#GNOME/glib!2978).\n","status":"published","published":"2023-04-28T15:35:18Z","modified":"2026-02-04T04:30:22.489325Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"UBUNTU-CVE-2023-24593","description":"Rejected reason: Rejected by upstream.","status":"published","published":"2023-03-29T00:00:00Z","modified":"2026-04-22T14:02:48.484144Z","updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"USN-6165-1","title":"glib2.0 vulnerabilities","description":"It was discovered that GLib incorrectly handled non-normal GVariants. An\nattacker could use this issue to cause GLib to crash, resulting in a denial\nof service, or perform other unknown attacks.\n","status":"published","published":"2023-06-14T13:26:19Z","modified":"2026-04-22T10:35:45.827987Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}