-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 15:20:28 +0100 Source: glib2.0 Architecture: source Version: 2.84.4-3~deb13u5 Distribution: trixie Urgency: medium Maintainer: Debian GNOME Maintainers Changed-By: Simon McVittie Closes: 1141316 1142717 1142835 Changes: glib2.0 (2.84.4-3~deb13u5) trixie; urgency=medium . * Add patches from upstream 2.89.x to fix parsing of XDG MIME magic datafiles - d/p/CVE-2026-16118/xdgmime-Check-if-caches-are-set-before-dumping-them.patch: Fix a crash when running tests on a minimal system - d/p/CVE-2026-16118/Fix-CVE-2026-16118-heap-buffer-overflow-in-xdgmimemagic.c.patch: Fix an out-of-bounds write if parsing attacker-controlled MIME-magic data. This is unlikely to be exploitable in practice, because an attacker with write access to $XDG_DATA_HOME/mime/magic is likely to have other ways to cause arbitrary code execution. (CVE-2026-16118, glib#3992 upstream, Closes: #1142717) . glib2.0 (2.84.4-3~deb13u4) trixie; urgency=medium . * Edit previous changelog entry to correlate CVE fixes with upstream bug numbers and releases * Add patches from upstream 2.86.5 to fix out-of-bounds accesses: - d/p/gvariant-Fix-an-off-by-one-error-in-an-offset-comparison.patch: Fix a potential out of bounds read by 1 byte (CVE-2026-58010, glib#3915 upstream) - d/p/gmarkup-Fix-potential-one-byte-overread-in-g_markup_escap.patch: Fix a potential out of bounds read by 1 byte when escaping text that is not valid UTF-8 (not considered to be a vulnerability, glib#3916 upstream) - d/p/gdatetime-Factor-out-a-couple-of-magic-constants.patch, d/p/gdatetime-Add-missing-range-validation-to-g_date_time_add.patch: Fix an out of bounds read by up to 2 bytes after parsing an out-of-range date (CVE-2026-58011, glib#3917 upstream) - d/p/gregex-Fix-case-changing-substitutions-with-G_REGEX_RAW.patch: Fix a potential buffer overflow when changing the case of an incomplete UTF-8 sequence while using G_REGEX_RAW (CVE-2026-58012, glib#3918 upstream) - d/p/gregex-Fix-use-of-wrong-option-flags-set-for-checking-for.patch, d/p/gregex-Rename-the-compile_opts-members-to-clarify-their-t.patch: Fix an out-of-bounds read when g_regex_split_full() acts on invalid UTF-8 (not considered to be a vulnerability, glib#3919 upstream) * Add patches from upstream 2.88.1 to fix several issues that were reported as potential security vulnerabilities: - d/p/giochannel-Fix-memcmp-off-the-end-of-the-buffer-with-long.patch: Fix out-of-bounds read if a GIOChannel is configured with a long line-terminator (CVE-2026-58013, glib#3825 upstream) - d/p/gkeyfile-Fix-a-one-byte-heap-under-read-with-g_key_file_g.patch: Fix out-of-bounds read if a list of locale-dependent strings in a GKeyFile is empty (CVE-2026-58014, glib#3930 upstream) - d/p/gdbusmessage-Fix-types-of-integer-arithmetic-in-message-l.patch: Fix an integer overflow that could lead to accepting overly large messages on peer-to-peer D-Bus connections (no CVE ID, glib#3933 upstream) - d/p/gdbusauthmechanismsha1-Validate-cookie-context.patch, d/p/gdbusauthmechanismsha1-Improve-validation-of-cookie-ID.patch, d/p/gdbusauthmechanism-Expose-client-reject-reason-as-a-new-v.patch, d/p/tests-Add-a-unit-test-for-GDBusAuthMechanismSha1-cookie-c.patch: Prevent path traversal and file-content disclosure if a D-Bus client connects to a malicious peer-to-peer D-Bus server (CVE-2026-58015, glib#3931 upstream) * Add patch from upstream 2.88.3 fixing a possible denial of service: - d/p/gdbusauth-Limit-length-of-lines-read-from-client.patch: Fix resource exhaustion if a malicious client can contact a GDBusServer (CVE-2026-15588, glib#3985 upstream, Closes: #1142835) * Add patches from upstream 2.89.0 to harden D-Bus introspection parsing - d/p/gdbusintrospection-Add-some-assertions-before-array-deref.patch, d/p/tests-Improve-D-Bus-introspection-test-paths.patch, d/p/gdbusintrospection-Fix-XML-parser-state-handling-for-node.patch, d/p/fuzzing-Add-a-fuzz-test-for-g_dbus_node_info_new_for_xml.patch: Avoid a possible integer underflow if parsing malformed D-Bus introspection XML sent by a malicious service (glib#3932 upstream, CVE-2026-58016, Closes: #1141316) * d/salsa-ci.yml: Disable uscan job as not relevant to this stable branch Checksums-Sha1: 02513a8ebbd960c5029e900fafccfe8ea93c8c4f 5294 glib2.0_2.84.4-3~deb13u5.dsc 6d92bf8dffbeee2369394a9f40a67f8fb71b478c 172260 glib2.0_2.84.4-3~deb13u5.debian.tar.xz 9b353f9d539cfed5d37a00add9f33829a35063fb 15145332 glib2.0_2.84.4-3~deb13u5.git.tar.xz 8855a2e8cea6ab6fb2aa6d69cb891ed56dd04790 17696 glib2.0_2.84.4-3~deb13u5_source.buildinfo Checksums-Sha256: 2587beb2f5b90511d0c88a7595c1d3b3ea7a5b7e6582713ecae3713864012858 5294 glib2.0_2.84.4-3~deb13u5.dsc d8e3603c3780d2cc883d762cf81db9199d8c4c492a82a1a791c117a6d402dbeb 172260 glib2.0_2.84.4-3~deb13u5.debian.tar.xz 568239a3a604022dec493408d0fc10f165639dd19a1eb20f8b01634ee0ce19bc 15145332 glib2.0_2.84.4-3~deb13u5.git.tar.xz 8daca739c81b87175322561351976ae779c7e2764982c9cb32949ccf9c881339 17696 glib2.0_2.84.4-3~deb13u5_source.buildinfo Files: d257f9927ee86ee1be6df1acea8c9efa 5294 libs optional glib2.0_2.84.4-3~deb13u5.dsc 3465d9f4fbaee31d4d9bf933b3ad43ed 172260 libs optional glib2.0_2.84.4-3~deb13u5.debian.tar.xz 9b23023f29becc2b6b956a29d32bd55c 15145332 libs optional glib2.0_2.84.4-3~deb13u5.git.tar.xz 83e336a108cd04d0d64352d6efb7fde4 17696 libs optional glib2.0_2.84.4-3~deb13u5_source.buildinfo Git-Tag-Info: tag=eb1c6804e6bb2fa38dec94d4037e3b30a55fbf5d fp=7a073ad1ae694fa25bff62e5235c099d3eb33076 Git-Tag-Tagger: Simon McVittie -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqLMEoACgkQYG0ITkaD wHnzZg//bOMScFzHsYV/2U6cdqWd3BgRMvfn/rJMCEwxQXTrUsAmn/DHSsHqlgxs mY5Qk+PfHwcPfF3rKiRCM5VZs4WoWwd611EAyr57viNhT4RRMOqEbw393f63CSMn MlmRu208MvW6S/gsJfol+tIZUFwaSkZX6Q0cS90SkQIPDuWQZFq+VsfRdy+y785x gkkGyeB1U/rQaeVLVu6jTOvPQ36yY9bg8xPfwm0Zf5Jrjy2rK9PZB7SoFcx3kPkL bKHIf9gsrtiGBb6p8knovwEUXF/6ngNRlBvyN4AaGAe9gXArHfTe9wiYSup0dd0h /p5mrzE/2WgDrdIEqbBMSUm5iRqIcpvhkSmCDZ3/GUPHPxubiGJBFDz8nDAvjwMm L05T9QNq4Q6aLtKqsf29+QTvIpMtqSgsX7Kua+llyTOrpKCkWiXijXDOC0hX8m4M Q7F1uXh59fHMQLn5TexLxR/DyKg80TO9bpUa1Be1vNNhQ854I6arINKngHT08M0a MAbtlO/DAjndPSspIVrxKPcv6kqAP4SZRZgcrwoY6Q2t6n7RKyi5kONjhYal0Ik8 JJH/onvUo2gV65Oq2U7qVQGiHlUHDi2qStKakY67BnXW3qD5I46TYZrytr1y3iNa CibI1nztFPKagzevQALSAPr2JybeKIMf1o1NT9TIBcHI9J37IoE= =B3I3 -----END PGP SIGNATURE-----