[From nobody Mon Aug 31 15:49:12 2026 Received: (at 1142835-close) by bugs.debian.org; 31 Aug 2026 14:47:21 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.7 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,MONEY,PGPSIGNATURE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 85; hammy, 150; neutral, 322; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:34638) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x13I9-007XQB-1t for 1142835-close@bugs.debian.org; Mon, 31 Aug 2026 14:47:21 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x13I8-008MPG-2D for 1142835-close@bugs.debian.org; Mon, 31 Aug 2026 14:47:21 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=U3J44XMT4ddIHa0qdGUX0xatasQx8uYGnAwnBRVrsjo=; b=nVqroSg8ZmFcZgntwdSfdVmJhj m2rMxjkfkSBFiA84XkIQssvYUmpCAdvcB3TnAaUPNTbcoKI9gZQZoRFIeWAhZbB5fukpU5OCoEI6D IRr7OdYbuo+nQjfqiDfrA9Hudq729obYYR/lHTaxfZgVOubik8gGP1gJ7q9NEIlz4wRVGe4Zu8Fdj 3nP9bDxTaQmtleKdTucmtteT1IxefW5q2EAzBqLlH8ZJAwBm7MBt0cIAVBcFDNvJE5/ZEObX3T2Uo aeXJni7GZ2CYQyIiHEi3CpSw+8+DTJMH12ju7MbAkyBPogmMtVG4+4jVMyy19LqGpPBWsokusNS47 75Xu4h9g==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x13I7-00000005Mbg-3FcL; Mon, 31 Aug 2026 14:47:19 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Simon McVittie <smcv@debian.org> To: 1142835-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: glib2.0 Debian: DAK Debian-Changes: glib2.0_2.84.4-3~deb13u4_source.changes Debian-Source: glib2.0 Debian-Version: 2.84.4-3~deb13u4 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1142835: fixed in glib2.0 2.84.4-3~deb13u4 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============5911976678009802704==" Message-Id: <E1x13I7-00000005Mbg-3FcL@fasolo.debian.org> Date: Mon, 31 Aug 2026 14:47:19 +0000 --===============5911976678009802704== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: glib2.0 Source-Version: 2.84.4-3~deb13u4 Done: Simon McVittie <smcv@debian.org> We believe that the bug you reported is fixed in the latest version of glib2.0, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1142835@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Simon McVittie <smcv@debian.org> (supplier of updated glib2.0 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 07 Aug 2026 10:33:15 +0100 Source: glib2.0 Architecture: source Version: 2.84.4-3~deb13u4 Distribution: trixie Urgency: medium Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debi= an.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1141316 1142835 Changes: glib2.0 (2.84.4-3~deb13u4) trixie; urgency=3Dmedium . * Edit previous changelog entry to correlate CVE fixes with upstream bug numbers and releases * Add patches from upstream 2.86.5 to fix out-of-bounds accesses: - d/p/gvariant-Fix-an-off-by-one-error-in-an-offset-comparison.patch: Fix a potential out of bounds read by 1 byte (CVE-2026-58010, glib#3915 upstream) - d/p/gmarkup-Fix-potential-one-byte-overread-in-g_markup_escap.patch: Fix a potential out of bounds read by 1 byte when escaping text that is not valid UTF-8 (not considered to be a vulnerability, glib#3916 upstream) - d/p/gdatetime-Factor-out-a-couple-of-magic-constants.patch, d/p/gdatetime-Add-missing-range-validation-to-g_date_time_add.patch: Fix an out of bounds read by up to 2 bytes after parsing an out-of-range date (CVE-2026-58011, glib#3917 upstream) - d/p/gregex-Fix-case-changing-substitutions-with-G_REGEX_RAW.patch: Fix a potential buffer overflow when changing the case of an incomplete UTF-8 sequence while using G_REGEX_RAW (CVE-2026-58012, glib#3918 upstream) - d/p/gregex-Fix-use-of-wrong-option-flags-set-for-checking-for.patch, d/p/gregex-Rename-the-compile_opts-members-to-clarify-their-t.patch: Fix an out-of-bounds read when g_regex_split_full() acts on invalid UTF-8 (not considered to be a vulnerability, glib#3919 upstream) * Add patches from upstream 2.88.1 to fix several issues that were reported as potential security vulnerabilities: - d/p/giochannel-Fix-memcmp-off-the-end-of-the-buffer-with-long.patch: Fix out-of-bounds read if a GIOChannel is configured with a long line-terminator (CVE-2026-58013, glib#3825 upstream) - d/p/gkeyfile-Fix-a-one-byte-heap-under-read-with-g_key_file_g.patch: Fix out-of-bounds read if a list of locale-dependent strings in a GKeyFile is empty (CVE-2026-58014, glib#3930 upstream) - d/p/gdbusmessage-Fix-types-of-integer-arithmetic-in-message-l.patch: Fix an integer overflow that could lead to accepting overly large messages on peer-to-peer D-Bus connections (no CVE ID, glib#3933 upstream) - d/p/gdbusauthmechanismsha1-Validate-cookie-context.patch, d/p/gdbusauthmechanismsha1-Improve-validation-of-cookie-ID.patch, d/p/gdbusauthmechanism-Expose-client-reject-reason-as-a-new-v.patch, d/p/tests-Add-a-unit-test-for-GDBusAuthMechanismSha1-cookie-c.patch: Prevent path traversal and file-content disclosure if a D-Bus client connects to a malicious peer-to-peer D-Bus server (CVE-2026-58015, glib#3931 upstream) * Add patch from upstream 2.88.3 fixing a possible denial of service: - d/p/gdbusauth-Limit-length-of-lines-read-from-client.patch: Fix resource exhaustion if a malicious client can contact a GDBusServer (CVE-2026-15588, glib#3985 upstream, Closes: #1142835) * Add patches from upstream 2.89.0 to harden D-Bus introspection parsing - d/p/gdbusintrospection-Add-some-assertions-before-array-deref.patch, d/p/tests-Improve-D-Bus-introspection-test-paths.patch, d/p/gdbusintrospection-Fix-XML-parser-state-handling-for-node.patch, d/p/fuzzing-Add-a-fuzz-test-for-g_dbus_node_info_new_for_xml.patch: Avoid a possible integer underflow if parsing malformed D-Bus introspection XML sent by a malicious service (glib#3932 upstream, CVE-2026-58016, Closes: #1141316) * d/salsa-ci.yml: Disable uscan job as not relevant to this stable branch Checksums-Sha1: bdf37b97b5bdfb928ec4641bde59cf152c024dea 5004 glib2.0_2.84.4-3~deb13u4.dsc 34c62ab7e2cf9b70090d0b9671546f9aba4badc8 171232 glib2.0_2.84.4-3~deb13u4.deb= ian.tar.xz dd9451045c58bc9d1d7ac93fba1c1383b4216df6 7787 glib2.0_2.84.4-3~deb13u4_sourc= e.buildinfo Checksums-Sha256: cfeaa8e8fb4a26f1348f5476a759b39bfdb41f52076d694ef181221f7b0865fd 5004 glib2.= 0_2.84.4-3~deb13u4.dsc 80ab88da1cbc594d3dbcf1ace06d25d86651b20378d11a91d27aae6ae39ca2ea 171232 glib= 2.0_2.84.4-3~deb13u4.debian.tar.xz 3d4def1c47c094ffc8d18a0078dfb9f7680bfd6c774327e5f0db2e591aab0935 7787 glib2.= 0_2.84.4-3~deb13u4_source.buildinfo Files: b55130ddd3fe6b4b8c6a78a2beb1a6a0 5004 libs optional glib2.0_2.84.4-3~deb13u4= .dsc 879462884894f8a64fe39abc6de9c6ee 171232 libs optional glib2.0_2.84.4-3~deb13= u4.debian.tar.xz 718e88b1b6c4a53533a31d3412b2b478 7787 libs optional glib2.0_2.84.4-3~deb13u4= _source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmp1tr4ACgkQI1wJnT6z MHbCMg//dtl4bCsh/sGRsjzua5RameeFRd4NTHki7gquKabC35LV+++eSp/MU//w XxmIQJ0t6ke2f/PEkDXfbx4hpKBeqlqIDF2Dcpi1pQZeFHIUZFIsG1zHinWc7n6Y jlnH+hhydokNqEde7MNj9v9GZFCVyztQD3+XESKBVZmILDuMgwmazfyZskxVgZIb az2rjrCrInxZqhud5KTyKOewi36HLBaIHQYhRltCcbE/WrbzlW2Hw8PoixO0hW+7 EtuM9B6pzRDPPiT9zJrDCYCgNyL9/sbZCE7IyZ6kUBeXrb/f42s0KdGBjnO16Bcq voqEeVFDtXmncqUZOny+pmiZg5QP5tjfJDxF5v2JdaN1CkDlj647eHLQMj+XpnbY 6DOxFXsaCfSC5wV3e9N9G03nsZ66hUu7G/rJFVWNyKKJ5INuSgOYIhxXQI5B+E11 GVqYmTA3sYJzN2lXII6x1jWBi/H+WxLxGlRK6BlPnDf2hh79ssB0d/8nejVWEaw5 td1IzEdT5fX/5r9NDRrBySriLv0OkxfA6c8mFl2wQ19xkYblvArLUX/j0Of7yqOI Vm7UpBbIdIkG3KQ2sYz/RywNEAVfZFW1U6wkQEu939agtzvO5XQxpswST6EJul0w xLEvRlutPYoNQc/Ry5NLvfdEEeC+cLExrxOHhQTOhzgxtQaTPHU=3D =3DY11X -----END PGP SIGNATURE----- --===============5911976678009802704== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCapWT9wAKCRCb9qggYcy5 IdycAP459Myyf+3y75AHHjfjXSGzthOFyopqI3Tbtv1LaFbO0QEAnXCrQcZ52IeK IWsOFvGtP7QWZgqKE4u0BAgEYxrOmAQ= =34Q1 -----END PGP SIGNATURE----- --===============5911976678009802704==-- ]