Your message dated Mon, 31 Aug 2026 14:47:20 +0000
with message-id <[email protected]>
and subject line Bug#1141316: fixed in glib2.0 2.84.4-3~deb13u5
has caused the Debian Bug report #1141316,
regarding glib2.0: CVE-2026-58016
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141316: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141316
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: glib2.0
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for glib2.0.
CVE-2026-58016[0]:
| A flaw was found in GLib. A state confusion issue exists in
| g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file
| when processing malformed D-Bus introspection XML, specifically with
| a <node> element nested within other elements like <method>,
| <signal>, <property> or <arg>. This issue can cause an unsigned
| integer overflow and lead to an out-of-bounds read, resulting in a
| denial of service.
https://gitlab.gnome.org/GNOME/glib/-/work_items/3932
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5156 (2.89.0)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-58016
https://www.cve.org/CVERecord?id=CVE-2026-58016
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: glib2.0
Source-Version: 2.84.4-3~deb13u5
Done: Simon McVittie <[email protected]>
We believe that the bug you reported is fixed in the latest version of
glib2.0, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Simon McVittie <[email protected]> (supplier of updated glib2.0 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 23 Aug 2026 15:20:28 +0100
Source: glib2.0
Architecture: source
Version: 2.84.4-3~deb13u5
Distribution: trixie
Urgency: medium
Maintainer: Debian GNOME Maintainers
<[email protected]>
Changed-By: Simon McVittie <[email protected]>
Closes: 1141316 1142717 1142835
Changes:
glib2.0 (2.84.4-3~deb13u5) trixie; urgency=medium
.
* Add patches from upstream 2.89.x to fix parsing of XDG MIME magic
datafiles
-
d/p/CVE-2026-16118/xdgmime-Check-if-caches-are-set-before-dumping-them.patch:
Fix a crash when running tests on a minimal system
-
d/p/CVE-2026-16118/Fix-CVE-2026-16118-heap-buffer-overflow-in-xdgmimemagic.c.patch:
Fix an out-of-bounds write if parsing attacker-controlled MIME-magic
data. This is unlikely to be exploitable in practice, because an
attacker with write access to $XDG_DATA_HOME/mime/magic is likely
to have other ways to cause arbitrary code execution.
(CVE-2026-16118, glib#3992 upstream, Closes: #1142717)
.
glib2.0 (2.84.4-3~deb13u4) trixie; urgency=medium
.
* Edit previous changelog entry to correlate CVE fixes with upstream
bug numbers and releases
* Add patches from upstream 2.86.5 to fix out-of-bounds accesses:
- d/p/gvariant-Fix-an-off-by-one-error-in-an-offset-comparison.patch:
Fix a potential out of bounds read by 1 byte
(CVE-2026-58010, glib#3915 upstream)
- d/p/gmarkup-Fix-potential-one-byte-overread-in-g_markup_escap.patch:
Fix a potential out of bounds read by 1 byte when escaping text that
is not valid UTF-8
(not considered to be a vulnerability, glib#3916 upstream)
- d/p/gdatetime-Factor-out-a-couple-of-magic-constants.patch,
d/p/gdatetime-Add-missing-range-validation-to-g_date_time_add.patch:
Fix an out of bounds read by up to 2 bytes after parsing an
out-of-range date
(CVE-2026-58011, glib#3917 upstream)
- d/p/gregex-Fix-case-changing-substitutions-with-G_REGEX_RAW.patch:
Fix a potential buffer overflow when changing the case of an incomplete
UTF-8 sequence while using G_REGEX_RAW
(CVE-2026-58012, glib#3918 upstream)
- d/p/gregex-Fix-use-of-wrong-option-flags-set-for-checking-for.patch,
d/p/gregex-Rename-the-compile_opts-members-to-clarify-their-t.patch:
Fix an out-of-bounds read when g_regex_split_full() acts on
invalid UTF-8
(not considered to be a vulnerability, glib#3919 upstream)
* Add patches from upstream 2.88.1 to fix several issues that were reported
as potential security vulnerabilities:
- d/p/giochannel-Fix-memcmp-off-the-end-of-the-buffer-with-long.patch:
Fix out-of-bounds read if a GIOChannel is configured with a long
line-terminator
(CVE-2026-58013, glib#3825 upstream)
- d/p/gkeyfile-Fix-a-one-byte-heap-under-read-with-g_key_file_g.patch:
Fix out-of-bounds read if a list of locale-dependent strings in a
GKeyFile is empty
(CVE-2026-58014, glib#3930 upstream)
- d/p/gdbusmessage-Fix-types-of-integer-arithmetic-in-message-l.patch:
Fix an integer overflow that could lead to accepting overly large
messages on peer-to-peer D-Bus connections
(no CVE ID, glib#3933 upstream)
- d/p/gdbusauthmechanismsha1-Validate-cookie-context.patch,
d/p/gdbusauthmechanismsha1-Improve-validation-of-cookie-ID.patch,
d/p/gdbusauthmechanism-Expose-client-reject-reason-as-a-new-v.patch,
d/p/tests-Add-a-unit-test-for-GDBusAuthMechanismSha1-cookie-c.patch:
Prevent path traversal and file-content disclosure if a D-Bus client
connects to a malicious peer-to-peer D-Bus server
(CVE-2026-58015, glib#3931 upstream)
* Add patch from upstream 2.88.3 fixing a possible denial of service:
- d/p/gdbusauth-Limit-length-of-lines-read-from-client.patch:
Fix resource exhaustion if a malicious client can contact a
GDBusServer
(CVE-2026-15588, glib#3985 upstream, Closes: #1142835)
* Add patches from upstream 2.89.0 to harden D-Bus introspection parsing
- d/p/gdbusintrospection-Add-some-assertions-before-array-deref.patch,
d/p/tests-Improve-D-Bus-introspection-test-paths.patch,
d/p/gdbusintrospection-Fix-XML-parser-state-handling-for-node.patch,
d/p/fuzzing-Add-a-fuzz-test-for-g_dbus_node_info_new_for_xml.patch:
Avoid a possible integer underflow if parsing malformed D-Bus
introspection XML sent by a malicious service
(glib#3932 upstream, CVE-2026-58016, Closes: #1141316)
* d/salsa-ci.yml: Disable uscan job as not relevant to this stable branch
Checksums-Sha1:
02513a8ebbd960c5029e900fafccfe8ea93c8c4f 5294 glib2.0_2.84.4-3~deb13u5.dsc
6d92bf8dffbeee2369394a9f40a67f8fb71b478c 172260
glib2.0_2.84.4-3~deb13u5.debian.tar.xz
9b353f9d539cfed5d37a00add9f33829a35063fb 15145332
glib2.0_2.84.4-3~deb13u5.git.tar.xz
8855a2e8cea6ab6fb2aa6d69cb891ed56dd04790 17696
glib2.0_2.84.4-3~deb13u5_source.buildinfo
Checksums-Sha256:
2587beb2f5b90511d0c88a7595c1d3b3ea7a5b7e6582713ecae3713864012858 5294
glib2.0_2.84.4-3~deb13u5.dsc
d8e3603c3780d2cc883d762cf81db9199d8c4c492a82a1a791c117a6d402dbeb 172260
glib2.0_2.84.4-3~deb13u5.debian.tar.xz
568239a3a604022dec493408d0fc10f165639dd19a1eb20f8b01634ee0ce19bc 15145332
glib2.0_2.84.4-3~deb13u5.git.tar.xz
8daca739c81b87175322561351976ae779c7e2764982c9cb32949ccf9c881339 17696
glib2.0_2.84.4-3~deb13u5_source.buildinfo
Files:
d257f9927ee86ee1be6df1acea8c9efa 5294 libs optional
glib2.0_2.84.4-3~deb13u5.dsc
3465d9f4fbaee31d4d9bf933b3ad43ed 172260 libs optional
glib2.0_2.84.4-3~deb13u5.debian.tar.xz
9b23023f29becc2b6b956a29d32bd55c 15145332 libs optional
glib2.0_2.84.4-3~deb13u5.git.tar.xz
83e336a108cd04d0d64352d6efb7fde4 17696 libs optional
glib2.0_2.84.4-3~deb13u5_source.buildinfo
Git-Tag-Info: tag=eb1c6804e6bb2fa38dec94d4037e3b30a55fbf5d
fp=7a073ad1ae694fa25bff62e5235c099d3eb33076
Git-Tag-Tagger: Simon McVittie <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqLMEoACgkQYG0ITkaD
wHnzZg//bOMScFzHsYV/2U6cdqWd3BgRMvfn/rJMCEwxQXTrUsAmn/DHSsHqlgxs
mY5Qk+PfHwcPfF3rKiRCM5VZs4WoWwd611EAyr57viNhT4RRMOqEbw393f63CSMn
MlmRu208MvW6S/gsJfol+tIZUFwaSkZX6Q0cS90SkQIPDuWQZFq+VsfRdy+y785x
gkkGyeB1U/rQaeVLVu6jTOvPQ36yY9bg8xPfwm0Zf5Jrjy2rK9PZB7SoFcx3kPkL
bKHIf9gsrtiGBb6p8knovwEUXF/6ngNRlBvyN4AaGAe9gXArHfTe9wiYSup0dd0h
/p5mrzE/2WgDrdIEqbBMSUm5iRqIcpvhkSmCDZ3/GUPHPxubiGJBFDz8nDAvjwMm
L05T9QNq4Q6aLtKqsf29+QTvIpMtqSgsX7Kua+llyTOrpKCkWiXijXDOC0hX8m4M
Q7F1uXh59fHMQLn5TexLxR/DyKg80TO9bpUa1Be1vNNhQ854I6arINKngHT08M0a
MAbtlO/DAjndPSspIVrxKPcv6kqAP4SZRZgcrwoY6Q2t6n7RKyi5kONjhYal0Ik8
JJH/onvUo2gV65Oq2U7qVQGiHlUHDi2qStKakY67BnXW3qD5I46TYZrytr1y3iNa
CibI1nztFPKagzevQALSAPr2JybeKIMf1o1NT9TIBcHI9J37IoE=
=B3I3
-----END PGP SIGNATURE-----
pgpKzu35O9Zlh.pgp
Description: PGP signature
--- End Message ---
