Your message dated Mon, 31 Aug 2026 14:47:19 +0000
with message-id <[email protected]>
and subject line Bug#1141316: fixed in glib2.0 2.84.4-3~deb13u4
has caused the Debian Bug report #1141316,
regarding glib2.0: CVE-2026-58016
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141316: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141316
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: glib2.0
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for glib2.0.
CVE-2026-58016[0]:
| A flaw was found in GLib. A state confusion issue exists in
| g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file
| when processing malformed D-Bus introspection XML, specifically with
| a <node> element nested within other elements like <method>,
| <signal>, <property> or <arg>. This issue can cause an unsigned
| integer overflow and lead to an out-of-bounds read, resulting in a
| denial of service.
https://gitlab.gnome.org/GNOME/glib/-/work_items/3932
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5156 (2.89.0)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-58016
https://www.cve.org/CVERecord?id=CVE-2026-58016
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: glib2.0
Source-Version: 2.84.4-3~deb13u4
Done: Simon McVittie <[email protected]>
We believe that the bug you reported is fixed in the latest version of
glib2.0, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Simon McVittie <[email protected]> (supplier of updated glib2.0 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 07 Aug 2026 10:33:15 +0100
Source: glib2.0
Architecture: source
Version: 2.84.4-3~deb13u4
Distribution: trixie
Urgency: medium
Maintainer: Debian GNOME Maintainers
<[email protected]>
Changed-By: Simon McVittie <[email protected]>
Closes: 1141316 1142835
Changes:
glib2.0 (2.84.4-3~deb13u4) trixie; urgency=medium
.
* Edit previous changelog entry to correlate CVE fixes with upstream
bug numbers and releases
* Add patches from upstream 2.86.5 to fix out-of-bounds accesses:
- d/p/gvariant-Fix-an-off-by-one-error-in-an-offset-comparison.patch:
Fix a potential out of bounds read by 1 byte
(CVE-2026-58010, glib#3915 upstream)
- d/p/gmarkup-Fix-potential-one-byte-overread-in-g_markup_escap.patch:
Fix a potential out of bounds read by 1 byte when escaping text that
is not valid UTF-8
(not considered to be a vulnerability, glib#3916 upstream)
- d/p/gdatetime-Factor-out-a-couple-of-magic-constants.patch,
d/p/gdatetime-Add-missing-range-validation-to-g_date_time_add.patch:
Fix an out of bounds read by up to 2 bytes after parsing an
out-of-range date
(CVE-2026-58011, glib#3917 upstream)
- d/p/gregex-Fix-case-changing-substitutions-with-G_REGEX_RAW.patch:
Fix a potential buffer overflow when changing the case of an incomplete
UTF-8 sequence while using G_REGEX_RAW
(CVE-2026-58012, glib#3918 upstream)
- d/p/gregex-Fix-use-of-wrong-option-flags-set-for-checking-for.patch,
d/p/gregex-Rename-the-compile_opts-members-to-clarify-their-t.patch:
Fix an out-of-bounds read when g_regex_split_full() acts on
invalid UTF-8
(not considered to be a vulnerability, glib#3919 upstream)
* Add patches from upstream 2.88.1 to fix several issues that were reported
as potential security vulnerabilities:
- d/p/giochannel-Fix-memcmp-off-the-end-of-the-buffer-with-long.patch:
Fix out-of-bounds read if a GIOChannel is configured with a long
line-terminator
(CVE-2026-58013, glib#3825 upstream)
- d/p/gkeyfile-Fix-a-one-byte-heap-under-read-with-g_key_file_g.patch:
Fix out-of-bounds read if a list of locale-dependent strings in a
GKeyFile is empty
(CVE-2026-58014, glib#3930 upstream)
- d/p/gdbusmessage-Fix-types-of-integer-arithmetic-in-message-l.patch:
Fix an integer overflow that could lead to accepting overly large
messages on peer-to-peer D-Bus connections
(no CVE ID, glib#3933 upstream)
- d/p/gdbusauthmechanismsha1-Validate-cookie-context.patch,
d/p/gdbusauthmechanismsha1-Improve-validation-of-cookie-ID.patch,
d/p/gdbusauthmechanism-Expose-client-reject-reason-as-a-new-v.patch,
d/p/tests-Add-a-unit-test-for-GDBusAuthMechanismSha1-cookie-c.patch:
Prevent path traversal and file-content disclosure if a D-Bus client
connects to a malicious peer-to-peer D-Bus server
(CVE-2026-58015, glib#3931 upstream)
* Add patch from upstream 2.88.3 fixing a possible denial of service:
- d/p/gdbusauth-Limit-length-of-lines-read-from-client.patch:
Fix resource exhaustion if a malicious client can contact a
GDBusServer
(CVE-2026-15588, glib#3985 upstream, Closes: #1142835)
* Add patches from upstream 2.89.0 to harden D-Bus introspection parsing
- d/p/gdbusintrospection-Add-some-assertions-before-array-deref.patch,
d/p/tests-Improve-D-Bus-introspection-test-paths.patch,
d/p/gdbusintrospection-Fix-XML-parser-state-handling-for-node.patch,
d/p/fuzzing-Add-a-fuzz-test-for-g_dbus_node_info_new_for_xml.patch:
Avoid a possible integer underflow if parsing malformed D-Bus
introspection XML sent by a malicious service
(glib#3932 upstream, CVE-2026-58016, Closes: #1141316)
* d/salsa-ci.yml: Disable uscan job as not relevant to this stable branch
Checksums-Sha1:
bdf37b97b5bdfb928ec4641bde59cf152c024dea 5004 glib2.0_2.84.4-3~deb13u4.dsc
34c62ab7e2cf9b70090d0b9671546f9aba4badc8 171232
glib2.0_2.84.4-3~deb13u4.debian.tar.xz
dd9451045c58bc9d1d7ac93fba1c1383b4216df6 7787
glib2.0_2.84.4-3~deb13u4_source.buildinfo
Checksums-Sha256:
cfeaa8e8fb4a26f1348f5476a759b39bfdb41f52076d694ef181221f7b0865fd 5004
glib2.0_2.84.4-3~deb13u4.dsc
80ab88da1cbc594d3dbcf1ace06d25d86651b20378d11a91d27aae6ae39ca2ea 171232
glib2.0_2.84.4-3~deb13u4.debian.tar.xz
3d4def1c47c094ffc8d18a0078dfb9f7680bfd6c774327e5f0db2e591aab0935 7787
glib2.0_2.84.4-3~deb13u4_source.buildinfo
Files:
b55130ddd3fe6b4b8c6a78a2beb1a6a0 5004 libs optional
glib2.0_2.84.4-3~deb13u4.dsc
879462884894f8a64fe39abc6de9c6ee 171232 libs optional
glib2.0_2.84.4-3~deb13u4.debian.tar.xz
718e88b1b6c4a53533a31d3412b2b478 7787 libs optional
glib2.0_2.84.4-3~deb13u4_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmp1tr4ACgkQI1wJnT6z
MHbCMg//dtl4bCsh/sGRsjzua5RameeFRd4NTHki7gquKabC35LV+++eSp/MU//w
XxmIQJ0t6ke2f/PEkDXfbx4hpKBeqlqIDF2Dcpi1pQZeFHIUZFIsG1zHinWc7n6Y
jlnH+hhydokNqEde7MNj9v9GZFCVyztQD3+XESKBVZmILDuMgwmazfyZskxVgZIb
az2rjrCrInxZqhud5KTyKOewi36HLBaIHQYhRltCcbE/WrbzlW2Hw8PoixO0hW+7
EtuM9B6pzRDPPiT9zJrDCYCgNyL9/sbZCE7IyZ6kUBeXrb/f42s0KdGBjnO16Bcq
voqEeVFDtXmncqUZOny+pmiZg5QP5tjfJDxF5v2JdaN1CkDlj647eHLQMj+XpnbY
6DOxFXsaCfSC5wV3e9N9G03nsZ66hUu7G/rJFVWNyKKJ5INuSgOYIhxXQI5B+E11
GVqYmTA3sYJzN2lXII6x1jWBi/H+WxLxGlRK6BlPnDf2hh79ssB0d/8nejVWEaw5
td1IzEdT5fX/5r9NDRrBySriLv0OkxfA6c8mFl2wQ19xkYblvArLUX/j0Of7yqOI
Vm7UpBbIdIkG3KQ2sYz/RywNEAVfZFW1U6wkQEu939agtzvO5XQxpswST6EJul0w
xLEvRlutPYoNQc/Ry5NLvfdEEeC+cLExrxOHhQTOhzgxtQaTPHU=
=Y11X
-----END PGP SIGNATURE-----
pgpu0WBYIJd8D.pgp
Description: PGP signature
--- End Message ---
