Bug#1121488: glib2.0: CVE-2025-13601

[Salvatore Bonaccorso]

Source: glib2.0
Version: 2.86.2-1
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/glib/-/issues/3827
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for glib2.0.

CVE-2025-13601[0]:
| A heap-based buffer overflow problem was found in glib through an
| incorrect calculation of buffer size in the g_escape_uri_string()
| function. If the string to escape contains a very large number of
| unacceptable characters (which would need escaping), the calculation
| of the length of the escaped string could overflow, leading to a
| potential write off the end of the newly allocated string.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-13601
    https://www.cve.org/CVERecord?id=CVE-2025-13601
[1] https://gitlab.gnome.org/GNOME/glib/-/issues/3827

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore