Re: [Buildroot] [PATCH v2 1/1] package/libglib2: security bump to version 2.88.3

On 04/08/2026 22:51, Fiona Klute via buildroot wrote:
> There have been a number of security fixes of mixed severity in
> libglib2 since 2.86.0, sorted by release:
> 
> 2.87.1
> * CVE-2025-13601: Incorrect calculation of buffer size in
>   g_escape_uri_string()
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3827
> * CVE-2025-14087: Buffer underflow on Glib through glib/gvariant via
>   bytestring_parse() or string_parse() leads to OOB Write
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3834
> * CVE-2025-14512: GIO: Integer overflow in file attribute escaping
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3845
> 
> 2.87.3
> * CVE-2026-1484: Integer Overflow -> Buffer Underflow on Glib through
>   glib/gbase64.c via g_base64_encode_close() leads to OOB Write
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3870
> * CVE-2026-1485: Buffer underflow on Glib through
>   gio/gcontenttype-fdo.c via parse_header() lead to OOB Read/Write
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3871
> * CVE-2026-1489: Integer Overflow on Glib through glib/guniprop.c via
>   output_marks() lead to OOB Write in glib/gutf8.c:g_unichar_to_utf8()
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3872
> 
> 2.88.1
> * CVE-2026-58010: Buffer Over-read on GLib through
>   glib/gvariant-serialiser.c:1253 via gvs_tuple_is_normal()
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3915
> * CVE-2026-58011: OOB Read on GLib through
>   glib/gdatetime.c:g_date_time_get_ymd via invalid `GDateTime`
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3917
> * CVE-2026-58012: Buffer Over-read on GLib's g_regex_replace() through
>   glib/gregex.c:string_append() via g_utf8_next_char()
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3918
> * CVE-2026-58013: Buffer Over-read on GLib through glib/giochannel.c
>   via "g_io_channel_read_line_backend"
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3925
> * CVE-2026-58014: Off-by-one Error on GLib through glib/gkeyfile.c via
>   "g_key_file_get_locale_string_list"
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3930
> * CVE-2026-58015: Path Traversal on GLib DBus through
>   glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry,
>   mechanism_client_data_receive (COOKIE_SHA1 Client Authentication)
>   leads to Arbitrary File Read (sort of)
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3931
> 
> 2.88.3
> * CVE-2026-15588: GDBusServer pre-authentication DoS via unbounded
>   SASL line buffering
>   https://gitlab.gnome.org/GNOME/glib/-/work_items/3985
> 
> Full upstream changelog:
> https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.3/NEWS?ref_type=tags
> 
> Signed-off-by: Fiona Klute <[email protected]>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot