Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libglib2.0 may reveal data or crash
published 3 months ago
Summary
The libglib2.0 library used in Ubuntu can read past the end of memory in several functions, which could let an attacker cause a crash or see unintended information. Updating to the latest packages (libglib2.0-0, libglib2.0-0-refdbg, libglib2.0-bin, libglib2.0-data, libglib2.0-dev) applies fixes that add proper boundary checks.
What to do
- Update canonical libglib2.0-0 to version 2.48.2-0ubuntu4.8+tuxcare.els7.
- Update canonical libglib2.0-0-refdbg to version 2.48.2-0ubuntu4.8+tuxcare.els7.
- Update canonical libglib2.0-bin to version 2.48.2-0ubuntu4.8+tuxcare.els7.
- Update canonical libglib2.0-data to version 2.48.2-0ubuntu4.8+tuxcare.els7.
- Update canonical libglib2.0-dev to version 2.48.2-0ubuntu4.8+tuxcare.els7.
- Update canonical libglib2.0-doc to version 2.48.2-0ubuntu4.8+tuxcare.els7.
- Update canonical libglib2.0-tests to version 2.48.2-0ubuntu4.8+tuxcare.els7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:16.04 | canonical | libglib2.0-0 |
< 2.48.2-0ubuntu4.8+tuxcare.els7 Fix: upgrade to 2.48.2-0ubuntu4.8+tuxcare.els7
|
| TuxCare:Ubuntu:16.04 | canonical | libglib2.0-0-refdbg |
< 2.48.2-0ubuntu4.8+tuxcare.els7 Fix: upgrade to 2.48.2-0ubuntu4.8+tuxcare.els7
|
| TuxCare:Ubuntu:16.04 | canonical | libglib2.0-bin |
< 2.48.2-0ubuntu4.8+tuxcare.els7 Fix: upgrade to 2.48.2-0ubuntu4.8+tuxcare.els7
|
| TuxCare:Ubuntu:16.04 | canonical | libglib2.0-data |
< 2.48.2-0ubuntu4.8+tuxcare.els7 Fix: upgrade to 2.48.2-0ubuntu4.8+tuxcare.els7
|
| TuxCare:Ubuntu:16.04 | canonical | libglib2.0-dev |
< 2.48.2-0ubuntu4.8+tuxcare.els7 Fix: upgrade to 2.48.2-0ubuntu4.8+tuxcare.els7
|
| TuxCare:Ubuntu:16.04 | canonical | libglib2.0-doc |
< 2.48.2-0ubuntu4.8+tuxcare.els7 Fix: upgrade to 2.48.2-0ubuntu4.8+tuxcare.els7
|
| TuxCare:Ubuntu:16.04 | canonical | libglib2.0-tests |
< 2.48.2-0ubuntu4.8+tuxcare.els7 Fix: upgrade to 2.48.2-0ubuntu4.8+tuxcare.els7
|
Original advisory text
Fix CVE(s): CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013
* SECURITY UPDATE: off-by-one out-of-bounds read in GVariant
normal-form checking
- debian/patches/CVE-2026-58010.patch: fix an off-by-one offset
comparison in gvs_tuple_is_normal()
- CVE-2026-58010
* SECURITY UPDATE: out-of-range GDateTime creation leading to
out-of-bounds reads in getter functions
- debian/patches/CVE-2026-58011.patch: add missing range validation
to g_date_time_add_full()
- CVE-2026-58011
* SECURITY UPDATE: buffer over-read in g_regex_replace() case-change
substitutions under G_REGEX_RAW
- debian/patches/CVE-2026-58012.patch: operate on bytes instead of
UTF-8 characters when changing case of raw-mode matches
- CVE-2026-58012
* SECURITY UPDATE: memcmp() buffer over-read in g_io_channel_read_line()
with multi-byte line terminators
- debian/patches/CVE-2026-58013.patch: check the remaining buffer
length against the line terminator length before memcmp()
- CVE-2026-58013
normal-form checking
- debian/patches/CVE-2026-58010.patch: fix an off-by-one offset
comparison in gvs_tuple_is_normal()
- CVE-2026-58010
* SECURITY UPDATE: out-of-range GDateTime creation leading to
out-of-bounds reads in getter functions
- debian/patches/CVE-2026-58011.patch: add missing range validation
to g_date_time_add_full()
- CVE-2026-58011
* SECURITY UPDATE: buffer over-read in g_regex_replace() case-change
substitutions under G_REGEX_RAW
- debian/patches/CVE-2026-58012.patch: operate on bytes instead of
UTF-8 characters when changing case of raw-mode matches
- CVE-2026-58012
* SECURITY UPDATE: memcmp() buffer over-read in g_io_channel_read_line()
with multi-byte line terminators
- debian/patches/CVE-2026-58013.patch: check the remaining buffer
length against the line terminator length before memcmp()
- CVE-2026-58013
References
- https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1783589822.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58010 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58011 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58012 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-58013 Vendor Advisory
Timeline
Published9 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1783589822 · OSV
Track software like this
Free during beta