{"id":"CVE-2023-32636","aliases":["ALSA-2024:2528","AZL-28778","BELL-CVE-2023-32636","CLSA-2023-1697135256","CLSA-2023-1697740212","CLSA-2023-1697740947","CLSA-2023-1697741722","CLSA-2023-1697741849","CLSA-2026-1777541282","EUVD-2023-36879","GHSA-79g9-vx8c-xfmq","JLSEC-2025-162","RHSA-2024:2528","SUSE-SU-2023:3535-1","UBUNTU-CVE-2023-32636","USN-6165-1","USN-6165-2"],"status":"published","title":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of...","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00791,"percentile":0.56732,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-502"],"published":"2023-06-07T00:00:00Z","modified":"2026-10-29T11:31:43Z","fixes":[{"ecosystem":"Azure Linux:2","package":"glib","fixed_in":["2.71.0-4"],"sources":["osv"]},{"ecosystem":"Julia","package":"Glib_jll","fixed_in":["2.76.5+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"glib2.0","fixed_in":["2.40.2-0ubuntu1.1+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glib2.0","fixed_in":["2.48.2-0ubuntu4.8+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glib2.0","fixed_in":["2.56.4-0ubuntu0.18.04.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","fixed_in":["2.64.6-1~ubuntu20.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","fixed_in":["2.72.4-0ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"mingw32-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mingw32-glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mingw64-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"mingw64-glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:2","package":"glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.71.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-0-refdbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-dev-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-163.el8.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-163.el8.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-163.el8.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-163.el8.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-163.el8.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-163.el8.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"Glib_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.76.5+0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mingw-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mingw32-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mingw32-glib2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mingw32-glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mingw64-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mingw64-glib2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"mingw64-glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.78.0-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-150000.4.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-150000.4.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-150000.4.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-150000.4.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-0ubuntu1.1+esm6"}]}],"versions":["2.38.0-1ubuntu1","2.38.1-1","2.39.1-0ubuntu1","2.39.1-0ubuntu2","2.39.1-0ubuntu3","2.39.2-0ubuntu1","2.39.2-0ubuntu2","2.39.3-0ubuntu4","2.39.4-0ubuntu1","2.39.90-0ubuntu1","2.39.91-0ubuntu2","2.39.91-0ubuntu3","2.39.92-2","2.40.0-1","2.40.0-1ubuntu1","2.40.0-2","2.40.2-0ubuntu1","2.40.2-0ubuntu1.1","2.40.2-0ubuntu1.1+esm1","2.40.2-0ubuntu1.1+esm2","2.40.2-0ubuntu1.1+esm3","2.40.2-0ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+esm3"}]}],"versions":["2.46.1-1","2.46.1-2","2.47.1-1","2.47.3-3","2.47.4-1","2.47.5-1","2.47.6-1","2.48.0-1ubuntu3","2.48.0-1ubuntu4","2.48.1-1~ubuntu16.04.1","2.48.2-0ubuntu1","2.48.2-0ubuntu3","2.48.2-0ubuntu4","2.48.2-0ubuntu4.1","2.48.2-0ubuntu4.2","2.48.2-0ubuntu4.3","2.48.2-0ubuntu4.4","2.48.2-0ubuntu4.5","2.48.2-0ubuntu4.6","2.48.2-0ubuntu4.7","2.48.2-0ubuntu4.8","2.48.2-0ubuntu4.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+esm3"}]}],"versions":["2.54.1-1ubuntu1","2.55.2-2ubuntu1","2.56.0-2ubuntu1","2.56.0-4ubuntu1","2.56.1-2ubuntu1","2.56.2-0ubuntu0.18.04.1","2.56.2-0ubuntu0.18.04.2","2.56.3-0ubuntu0.18.04.1","2.56.4-0ubuntu0.18.04.2","2.56.4-0ubuntu0.18.04.3","2.56.4-0ubuntu0.18.04.4","2.56.4-0ubuntu0.18.04.5","2.56.4-0ubuntu0.18.04.6","2.56.4-0ubuntu0.18.04.7","2.56.4-0ubuntu0.18.04.8","2.56.4-0ubuntu0.18.04.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.64.6-1~ubuntu20.04.6"}]}],"versions":["2.62.1-1","2.63.1-2","2.63.1-2ubuntu1","2.63.3-1","2.63.3-3","2.63.5-2","2.64.0-1","2.64.1-1","2.64.2-1~fakesync1","2.64.3-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.2","2.64.6-1~ubuntu20.04.3","2.64.6-1~ubuntu20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.4-0ubuntu2.2"}]}],"versions":["2.68.4-1ubuntu1","2.70.1-1","2.70.2-1","2.71.0-2","2.71.1-1","2.71.2-1","2.71.3-1","2.72.0-1","2.72.1-1","2.72.4-0ubuntu1","2.72.4-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.64.6-1~ubuntu20.04.6"}]}],"versions":["2.62.1-1","2.63.1-2","2.63.1-2ubuntu1","2.63.3-1","2.63.3-3","2.63.5-2","2.64.0-1","2.64.1-1","2.64.2-1~fakesync1","2.64.3-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.2","2.64.6-1~ubuntu20.04.3","2.64.6-1~ubuntu20.04.4"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.4-0ubuntu2.2"}]}],"versions":["2.68.4-1ubuntu1","2.70.1-1","2.70.2-1","2.71.0-2","2.71.1-1","2.71.2-1","2.71.3-1","2.72.0-1","2.72.1-1","2.72.4-0ubuntu1","2.72.4-0ubuntu2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-0ubuntu1.1+esm6"}]}],"versions":["2.38.0-1ubuntu1","2.38.1-1","2.39.1-0ubuntu1","2.39.1-0ubuntu2","2.39.1-0ubuntu3","2.39.2-0ubuntu1","2.39.2-0ubuntu2","2.39.3-0ubuntu4","2.39.4-0ubuntu1","2.39.90-0ubuntu1","2.39.91-0ubuntu2","2.39.91-0ubuntu3","2.39.92-2","2.40.0-1","2.40.0-1ubuntu1","2.40.0-2","2.40.2-0ubuntu1","2.40.2-0ubuntu1.1","2.40.2-0ubuntu1.1+esm1","2.40.2-0ubuntu1.1+esm2","2.40.2-0ubuntu1.1+esm3","2.40.2-0ubuntu1.1+esm4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+esm3"}]}],"versions":["2.46.1-1","2.46.1-2","2.47.1-1","2.47.3-3","2.47.4-1","2.47.5-1","2.47.6-1","2.48.0-1ubuntu3","2.48.0-1ubuntu4","2.48.1-1~ubuntu16.04.1","2.48.2-0ubuntu1","2.48.2-0ubuntu3","2.48.2-0ubuntu4","2.48.2-0ubuntu4.1","2.48.2-0ubuntu4.2","2.48.2-0ubuntu4.3","2.48.2-0ubuntu4.4","2.48.2-0ubuntu4.5","2.48.2-0ubuntu4.6","2.48.2-0ubuntu4.7","2.48.2-0ubuntu4.8","2.48.2-0ubuntu4.8+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+esm3"}]}],"versions":["2.54.1-1ubuntu1","2.55.2-2ubuntu1","2.56.0-2ubuntu1","2.56.0-4ubuntu1","2.56.1-2ubuntu1","2.56.2-0ubuntu0.18.04.1","2.56.2-0ubuntu0.18.04.2","2.56.3-0ubuntu0.18.04.1","2.56.4-0ubuntu0.18.04.2","2.56.4-0ubuntu0.18.04.3","2.56.4-0ubuntu0.18.04.4","2.56.4-0ubuntu0.18.04.5","2.56.4-0ubuntu0.18.04.6","2.56.4-0ubuntu0.18.04.7","2.56.4-0ubuntu0.18.04.8","2.56.4-0ubuntu0.18.04.9"],"bundled":5}],"products":[{"vendor":"glib","product":"glib"},{"vendor":"gnome","product":"glib"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/2841","tags":["x_transferred","Issue Tracking","Vendor Advisory","report","web","article"]},{"url":"https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835","tags":["x_transferred","Broken Link","web"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0002/","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32636","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231110-0002"},{"url":"https://github.com/advisories/GHSA-79g9-vx8c-xfmq"},{"url":"https://access.redhat.com/errata/RHSA-2024:2528","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29499","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32611","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32636","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32665","tags":["report"]},{"url":"https://bugzilla.redhat.com/2211827","tags":["report"]},{"url":"https://bugzilla.redhat.com/2211828","tags":["report"]},{"url":"https://bugzilla.redhat.com/2211829","tags":["report"]},{"url":"https://bugzilla.redhat.com/2211833","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2528.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-32636","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos7-els/CLSA-2023-1697135256.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2023-1697740212.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2023-1697740947.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1697741722","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1697741849","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1777541282.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32636.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211828","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2211833","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2528.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-29499","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29499","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/2794","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32611","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/2797","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32636","tags":["advisory","report"]},{"url":"https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32665","tags":["advisory"]},{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/2121","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233535-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183533","tags":["report"]},{"url":"https://bugzilla.suse.com/1211945","tags":["report"]},{"url":"https://bugzilla.suse.com/1211946","tags":["report"]},{"url":"https://bugzilla.suse.com/1211947","tags":["report"]},{"url":"https://bugzilla.suse.com/1211948","tags":["report"]},{"url":"https://bugzilla.suse.com/1211951","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32665","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-32636","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6165-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6165-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-24593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32665","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-32636","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","status":"published","published":"2023-09-14T19:19:21.874Z","modified":"2026-10-14T23:17:10.448Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-36879","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","status":"published","published":"2023-09-14T19:19:21Z","modified":"2026-10-14T23:17:10Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:11.209168Z"}],"ghsa":[{"id":"GHSA-79g9-vx8c-xfmq","title":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of...","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","status":"published","published":"2023-09-14T21:30:26Z","modified":"2026-10-15T00:31:43Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-502"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2023-32636","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","status":"published","published":"2023-09-14T20:15:09.653Z","modified":"2026-10-15T00:16:32.51Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-502"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"AZL-28778","title":"CVE-2023-32636 affecting package glib for versions less than 2.71.0-4","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","status":"published","published":"2023-09-14T20:15:09Z","modified":"2026-04-21T04:25:59.319364Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"BELL-CVE-2023-32636","title":"CVE-2023-32636 does not affect BellSoft software","status":"withdrawn","published":"2023-09-14T20:15:00Z","modified":"2026-01-26T09:46:44.005098Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-32636","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","status":"published","published":"2023-09-14T19:19:21.874Z","modified":"2026-10-28T02:30:29.182648873Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"JLSEC-2025-162","title":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of...","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","status":"published","published":"2025-10-19T22:31:43.957Z","modified":"2026-07-23T22:30:15.064207918Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"RHSA-2024:2528","title":"Red Hat Security Advisory: mingw-glib2 security update","status":"published","published":"2024-09-16T15:51:55Z","modified":"2026-06-30T10:07:12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-32636","description":"A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.","status":"published","published":"2023-06-07T00:00:00Z","modified":"2026-04-22T14:06:48.028228Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"ALSA-2024:2528","title":"Low: mingw-glib2 security update","description":"GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.\n\nSecurity Fix(es):\n\n* glib: GVariant offset table entry size is not checked in is_normal() (CVE-2023-29499)\n* glib: g_variant_byteswap() can take a long time with some non-normal inputs (CVE-2023-32611)\n* glib: Timeout in fuzz_variant_text (CVE-2023-32636)\n* glib: GVariant deserialisation does not match spec for non-normal data (CVE-2023-32665)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:43.266488095Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2023-1697135256","title":"glib2: Fix of 5 CVEs","description":"- CVE-2023-29499: Fix GVariant offset table entry size which is not checked\n  in is_normal()\n- CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time\n  with some non-normal inputs\n- CVE-2023-32665: Fix GVariant deserialisation which does not match spec\n  for non-normal data\n- CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()\n- CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()\n- Fix g_test_bug assertion in gvariant test","status":"published","published":"2023-10-12T18:27:40Z","modified":"2026-10-21T10:47:52.3041045Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697740212","title":"glib2: Fix of 5 CVEs","description":"- Enable internal tests\n- Skip several failed tests from the check\n- CVE-2023-29499: Fix GVariant offset table entry size which is not checked\n  in is_normal()\n- CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time\n  with some non-normal inputs\n- CVE-2023-32665: Fix GVariant deserialisation which does not match spec\n  for non-normal data\n- CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()\n- CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()\n- Fix g_test_bug assertion in gvariant test","status":"published","published":"2023-10-19T18:30:17Z","modified":"2026-10-21T10:48:16.247505036Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697740947","title":"glib2: Fix of 5 CVEs","description":"- Enable internal tests\n- Skip several failed tests from the check\n- CVE-2023-29499: Fix GVariant offset table entry size which is not checked\n  in is_normal()\n- CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time\n  with some non-normal inputs\n- CVE-2023-32665: Fix GVariant deserialisation which does not match spec\n  for non-normal data\n- CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()\n- CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()\n- Fix g_test_bug assertion in gvariant test","status":"published","published":"2023-10-19T18:42:31Z","modified":"2026-10-21T10:48:07.192502033Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697741722","title":"Fix of 5 CVEs","description":"\n   * SECURITY UPDATE: GVariant security issues\n     - debian/patches/CVE-2023-29499-x-CVE-2023-32665/*.patch: fix multiple\n       GVariant serialization issues\n     - CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643,\n       CVE-2023-32665\n   * debian/patches/fix-g_test_bug-assertion.patch: Fix g_test_bug assertion\n     in gvariant test\n   * debian/patches/libglib2.0-0.symbols: Add new symbols","status":"published","published":"2023-10-19T18:55:27Z","modified":"2026-06-04T10:03:37.244723421Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697741849","title":"Fix of 5 CVEs","description":"\n   * SECURITY UPDATE: GVariant security issues\n     - debian/patches/CVE-2023-29499-x-CVE-2023-32665/*.patch: fix multiple\n       GVariant serialization issues\n     - CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643,\n       CVE-2023-32665\n   * debian/patches/fix-g_test_bug-assertion.patch: Fix g_test_bug assertion\n     in gvariant test\n   * debian/patches/skip-several-failed-tests.patch: Skip several failed tests\n   * debian/patches/libglib2.0-0.symbols: Add new symbol","status":"published","published":"2023-10-19T18:57:34Z","modified":"2026-06-04T10:04:16.64485Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2026-1777541282","title":"glib2: Fix of 2 CVEs","description":"- CVE-2023-29499: fix GVariant offset table entry size which is not checked\n  in is_normal().\n- CVE-2023-32636: remediate GVariant deserialisation timeout regression\n  introduced by the CVE-2023-29499 fix.\n- Backported upstream MR 3126 (22 commits) from centos8.5els.","status":"published","published":"2026-04-30T09:28:06Z","modified":"2026-06-01T00:33:14.364275328Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"SUSE-SU-2023:3535-1","title":"Security update for glib2","description":"This update for glib2 fixes the following issues:\n\n- CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files. (bsc#1183533)\n- CVE-2023-32665: Fixed GVariant deserialisation which does not match spec for non-normal data. (bsc#1211945)\n- CVE-2023-32643: Fixed a heap-buffer-overflow in g_variant_serialised_get_child(). (bsc#1211946)\n- CVE-2023-29499: Fixed GVariant offset table entry size which is not checked in is_normal(). (bsc#1211947)\n- CVE-2023-32636: Fixed a wrong timeout in fuzz_variant_text(). (bsc#1211948)\n- CVE-2023-32611: Fixed an issue where g_variant_byteswap() can take a long time with some non-normal inputs. (bsc#1211951)\n","status":"published","published":"2023-09-05T12:47:12Z","modified":"2026-02-04T02:52:08.989259Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6165-1","title":"glib2.0 vulnerabilities","description":"It was discovered that GLib incorrectly handled non-normal GVariants. An\nattacker could use this issue to cause GLib to crash, resulting in a denial\nof service, or perform other unknown attacks.\n","status":"published","published":"2023-06-14T13:26:19Z","modified":"2026-04-22T10:35:45.827987Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-6165-2","title":"glib2.0 vulnerabilities","description":"USN-6165-1 fixed vulnerabilities in GLib. This update provides the\ncorresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu\n18.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that GLib incorrectly handled non-normal GVariants. An\n attacker could use this issue to cause GLib to crash, resulting in a\n denial of service, or perform other unknown attacks.\n","status":"published","published":"2023-10-19T11:46:21Z","modified":"2026-06-29T13:50:52.884865447Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}