Security update for glib2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:4441-1 Final 1 1 2025-12-17T16:15:21Z current 2025-12-17T16:15:21Z 2025-12-17T16:15:21Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for glib2 This update for glib2 fixes the following issues: - CVE-2025-14512: integer overflow in the GIO `escape_byte_string()` function when processing malicious files or remote filesystem attribute values can lead to denial-of-service (bsc#1254878). - CVE-2025-14087: buffer underflow in the GVariant parser `bytestring_parse()` and `string_parse()` functions when processing attacker-influenced data may lead to crash or code execution (bsc#1254662). - CVE-2025-13601: heap-based buffer overflow in the `g_escape_uri_string()` function when processing strings with a large number of unacceptable characters may lead to crash or code execution (bsc#1254297). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-4441,SUSE-SLE-SERVER-12-SP5-LTSS-2025-4441,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-4441 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-20254441-1/ Link for SUSE-SU-2025:4441-1 https://lists.suse.com/pipermail/sle-security-updates/2025-December/023585.html E-Mail link for SUSE-SU-2025:4441-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1254297 SUSE Bug 1254297 https://bugzilla.suse.com/1254662 SUSE Bug 1254662 https://bugzilla.suse.com/1254878 SUSE Bug 1254878 https://www.suse.com/security/cve/CVE-2025-13601/ SUSE CVE CVE-2025-13601 page https://www.suse.com/security/cve/CVE-2025-14087/ SUSE CVE CVE-2025-14087 page https://www.suse.com/security/cve/CVE-2025-14512/ SUSE CVE CVE-2025-14512 page SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 gio-branding-upstream-2.48.2-12.52.1 glib2-devel-2.48.2-12.52.1 glib2-devel-32bit-2.48.2-12.52.1 glib2-devel-64bit-2.48.2-12.52.1 glib2-devel-static-2.48.2-12.52.1 glib2-lang-2.48.2-12.52.1 glib2-tools-2.48.2-12.52.1 glib2-tools-32bit-2.48.2-12.52.1 glib2-tools-64bit-2.48.2-12.52.1 libgio-2_0-0-2.48.2-12.52.1 libgio-2_0-0-32bit-2.48.2-12.52.1 libgio-2_0-0-64bit-2.48.2-12.52.1 libgio-fam-2.48.2-12.52.1 libgio-fam-32bit-2.48.2-12.52.1 libgio-fam-64bit-2.48.2-12.52.1 libglib-2_0-0-2.48.2-12.52.1 libglib-2_0-0-32bit-2.48.2-12.52.1 libglib-2_0-0-64bit-2.48.2-12.52.1 libgmodule-2_0-0-2.48.2-12.52.1 libgmodule-2_0-0-32bit-2.48.2-12.52.1 libgmodule-2_0-0-64bit-2.48.2-12.52.1 libgobject-2_0-0-2.48.2-12.52.1 libgobject-2_0-0-32bit-2.48.2-12.52.1 libgobject-2_0-0-64bit-2.48.2-12.52.1 libgthread-2_0-0-2.48.2-12.52.1 libgthread-2_0-0-32bit-2.48.2-12.52.1 libgthread-2_0-0-64bit-2.48.2-12.52.1 glib2-devel-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS glib2-devel-static-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS glib2-lang-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS glib2-tools-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libgio-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libgio-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libglib-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libglib-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libgmodule-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libgmodule-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libgobject-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libgobject-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libgthread-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS libgthread-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server 12 SP5-LTSS glib2-devel-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 glib2-devel-static-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 glib2-lang-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 glib2-tools-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libgio-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libgio-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libglib-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libglib-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libgmodule-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libgmodule-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libgobject-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libgobject-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libgthread-2_0-0-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 libgthread-2_0-0-32bit-2.48.2-12.52.1 as a component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. CVE-2025-13601 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-static-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-lang-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-tools-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgio-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgio-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libglib-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libglib-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgmodule-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgmodule-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgobject-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgobject-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgthread-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgthread-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-devel-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-devel-static-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-lang-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-tools-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgio-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgio-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libglib-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libglib-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgmodule-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgmodule-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgobject-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgobject-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgthread-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgthread-2_0-0-32bit-2.48.2-12.52.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20254441-1/ https://www.suse.com/security/cve/CVE-2025-13601.html CVE-2025-13601 https://bugzilla.suse.com/1254297 SUSE Bug 1254297 A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings. CVE-2025-14087 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-static-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-lang-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-tools-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgio-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgio-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libglib-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libglib-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgmodule-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgmodule-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgobject-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgobject-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgthread-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgthread-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-devel-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-devel-static-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-lang-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-tools-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgio-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgio-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libglib-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libglib-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgmodule-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgmodule-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgobject-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgobject-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgthread-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgthread-2_0-0-32bit-2.48.2-12.52.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20254441-1/ https://www.suse.com/security/cve/CVE-2025-14087.html CVE-2025-14087 https://bugzilla.suse.com/1254662 SUSE Bug 1254662 A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values. CVE-2025-14512 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-devel-static-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-lang-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:glib2-tools-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgio-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgio-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libglib-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libglib-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgmodule-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgmodule-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgobject-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgobject-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgthread-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server 12 SP5-LTSS:libgthread-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-devel-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-devel-static-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-lang-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:glib2-tools-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgio-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgio-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libglib-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libglib-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgmodule-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgmodule-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgobject-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgobject-2_0-0-32bit-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgthread-2_0-0-2.48.2-12.52.1 SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libgthread-2_0-0-32bit-2.48.2-12.52.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20254441-1/ https://www.suse.com/security/cve/CVE-2025-14512.html CVE-2025-14512 https://bugzilla.suse.com/1254878 SUSE Bug 1254878