USN-8794-1 glib2.0 vulnerabilities

It was discovered that GLib's GDBus authentication mechanism failed to enforce length limitations on data lines read from a client. An unauthenticated attacker could exploit this to cause a denial of service via resource exhaustion. CVE-2026-15588 It was discovered that the xdgmime library in GLi...

EulerOS Virtualization 2.12.1 : glib2 (EulerOS-SA-2026-3585)

According to the versions of the glib2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the gdatetimegetymd function in the glib/gdatetime.c fil...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

Unity Linux 20.1060a / 20.1070a Security Update: glib2 (UTSA-2026-105539)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105539 advisory. A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter...

JLSEC-2026-1248 A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL...

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

CLSA-2026-1783690752 glib2: Fix of 2 CVEs

CVE-2026-58014: fix one-byte heap under-read in gkeyfilegetlocalestringlist with an empty value - CVE-2026-58015: validate DBUSCOOKIESHA1 cookiecontext to prevent server-controlled path traversal / arbitrary file read...

CLSA-2026-1783671013 glib2: Fix of 2 CVEs

CVE-2026-58014: fix one-byte heap under-read in gkeyfilegetlocalestringlist with an empty value - CVE-2026-58015: validate DBUSCOOKIESHA1 cookiecontext to prevent server-controlled path traversal / arbitrary file read...

CLSA-2026-1783341999 glib2: Fix of 3 CVEs

CVE-2026-58016: fix inverted nesting guard in the GDBus introspection XML parser gio/gdbusintrospection.c - CVE-2026-58015: validate the DBUSCOOKIESHA1 cookiecontext to avoid keyring path traversal gio/gdbusauthmechanismsha1.c - CVE-2026-58014: guard the empty-value case in...

CVE-2026-58015

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

GNOME glib security vulnerability

Versions of GNOME Glib prior to 2.88.1 contain a security vulnerability. This vulnerability stems from the DBUSCOOKIESHA1 SASL authentication mechanism in the D-Bus client failing to validate the received cookiecontext parameter. As a result, a malicious D-Bus server may supply a cookiecontext...

SUSE: Security Advisory (SUSE-SU-2019:1597-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for dbus (EulerOS-SA-2019-1706)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2019-0339 Updated dbus packages fix security vulnerability

dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ubuntu 14.04 and in some, less common, uses of dbus-daemon, allows cookie spoofing because of symlink mishandling in the reference implementation of DBUSCOOKIESHA1 in the libdbus...

SUSE SLED12 / SLES12 Security Update : dbus-1 (SUSE-SU-2019:2820-1)

This update for dbus-1 fixes the following issues : Security issue fixed : CVE-2019-12749: Fixed an implementation flaw in DBUSCOOKIESHA1 which could have allowed local attackers to bypass authentication bsc1137832. Note that Tenable Network Security has extracted the preceding description block...

Important: Red Hat Security Advisory: dbus security update

An update for dbus is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...

Oracle Linux 6 : dbus (ELSA-2019-1726)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1726 advisory. - Apply patch for CVE-2019-12749 1725574 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessu...