[Buildroot] [PATCH 1/1] package/libglib2: security bump to version 2.88.3

There have been a number of security fixes of mixed severity in
libglib2 since 2.86.0, sorted by release:

2.87.1
* CVE-2025-13601: Incorrect calculation of buffer size in
  g_escape_uri_string()
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3827
* CVE-2025-14087: Buffer underflow on Glib through glib/gvariant via
  bytestring_parse() or string_parse() leads to OOB Write
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3834
* CVE-2025-14512: GIO: Integer overflow in file attribute escaping
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3845

2.87.3
* CVE-2026-1484: Integer Overflow -> Buffer Underflow on Glib through
  glib/gbase64.c via g_base64_encode_close() leads to OOB Write
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3870
* CVE-2026-1485: Buffer underflow on Glib through
  gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3871
* CVE-2026-1489: Integer Overflow on Glib through glib/guniprop.c via
  output_marks() lead to OOB Write in glib/gutf8.c:g_unichar_to_utf8()
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3872

2.88.1
* CVE-2026-58010: Buffer Over-read on GLib through
  glib/gvariant-serialiser.c:1253 via gvs_tuple_is_normal()
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3915
* CVE-2026-58011: OOB Read on GLib through
  glib/gdatetime.c:g_date_time_get_ymd via invalid `GDateTime`
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3917
* CVE-2026-58012: Buffer Over-read on GLib's g_regex_replace() through
  glib/gregex.c:string_append() via g_utf8_next_char()
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3918
* CVE-2026-58013: Buffer Over-read on GLib through glib/giochannel.c
  via "g_io_channel_read_line_backend"
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3925
* CVE-2026-58014: Off-by-one Error on GLib through glib/gkeyfile.c via
  "g_key_file_get_locale_string_list"
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3930
* CVE-2026-58015: Path Traversal on GLib DBus through
  glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry,
  mechanism_client_data_receive (COOKIE_SHA1 Client Authentication)
  leads to Arbitrary File Read (sort of)
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3931

2.88.3
* CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
  SASL line buffering
  https://gitlab.gnome.org/GNOME/glib/-/work_items/3985

Full upstream changelog:
https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.3/NEWS?ref_type=tags

Signed-off-by: Fiona Klute <[email protected]>
---
 package/libglib2/libglib2.hash | 2 +-
 package/libglib2/libglib2.mk   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/libglib2/libglib2.hash b/package/libglib2/libglib2.hash
index 09cd8e9979..c06fce8742 100644
--- a/package/libglib2/libglib2.hash
+++ b/package/libglib2/libglib2.hash
@@ -1,4 +1,4 @@
 # https://download.gnome.org/sources/glib/2.86/glib-2.86.5.sha256sum
-sha256  ce85a947bb8b3c0204dbeff79aec39bcb46371c6fafb64ba5b8726c71e038d5f  glib-2.86.5.tar.xz
+sha256  ab24d24e698dfa1e408b7bcdb508f4aafc906185a8b8ce72fdf79bbbdc9b383b  glib-2.88.3.tar.xz
 # License files, locally calculated
 sha256  fa6f36630bb1e0c571d34b2bbdf188d08495c9dbf58f28cac112f303fc1f58fb  COPYING
diff --git a/package/libglib2/libglib2.mk b/package/libglib2/libglib2.mk
index ae4b653a15..bfe4920291 100644
--- a/package/libglib2/libglib2.mk
+++ b/package/libglib2/libglib2.mk
@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-LIBGLIB2_VERSION_MAJOR = 2.86
-LIBGLIB2_VERSION = $(LIBGLIB2_VERSION_MAJOR).5
+LIBGLIB2_VERSION_MAJOR = 2.88
+LIBGLIB2_VERSION = $(LIBGLIB2_VERSION_MAJOR).3
 LIBGLIB2_SOURCE = glib-$(LIBGLIB2_VERSION).tar.xz
 LIBGLIB2_SITE = https://download.gnome.org/sources/glib/$(LIBGLIB2_VERSION_MAJOR)
 LIBGLIB2_LICENSE = LGPL-2.1+
-- 
2.55.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot