MGASA-2024-0311 - Updated glib2.0 packages fix security vulnerability

Publication date: 25 Sep 2024
URL: https://advisories.mageia.org/MGASA-2024-0311.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2024-34397

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and
2.80.x before 2.80.1. When a GDBus-based client subscribes to signals
from a trusted system service such as NetworkManager on a shared
computer, other users of the same computer can send spoofed D-Bus
signals that the GDBus-based client will wrongly interpret as having
been sent by the trusted system service. This could lead to the
GDBus-based client behaving incorrectly, with an application-dependent
impact. (CVE-2024-34397)

References:
- https://bugs.mageia.org/show_bug.cgi?id=33198
- https://www.openwall.com/lists/oss-security/2024/05/07/5
- https://ubuntu.com/security/notices/USN-6768-1
- https://lwn.net/Articles/975988/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34397

SRPMS:
- 9/core/glib2.0-2.76.3-1.2.mga9

Mageia 2024-0311: glib2.0 Security Advisory Updates

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1

Summary

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact. (CVE-2024-34397)

References

- https://bugs.mageia.org/show_bug.cgi?id=33198

- https://www.openwall.com/lists/oss-security/2024/05/07/5

- https://ubuntu.com/security/notices/USN-6768-1

- https://lwn.net/Articles/975988/

- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34397

Resolution

MGASA-2024-0311 - Updated glib2.0 packages fix security vulnerability

SRPMS

- 9/core/glib2.0-2.76.3-1.2.mga9

Severity
Publication date: 25 Sep 2024
URL: https://advisories.mageia.org/MGASA-2024-0311.html
Type: security
CVE: CVE-2024-34397

Related News

Essential Server Security Security Strategies for Administrators
5 - 9 min read
In the current threat landscape, Linux servers have emerged as a dominant force, underpinning approximately 81% of all websites globally. Despite
Google Chooses Passkeys Over Passwords: Examining the Security Benefits for Linux Users
2 - 4 min read
In a bold move towards a future without traditional passwords, Google has introduced secure passkey sign-ins across almost all devices, including
Linux Security Modules (LSM): SELinux vs AppArmor vs TOMOYO
3 - 6 min read
Linux has long been celebrated for its versatility, robustness, and vast array of security features it offers. A key aspect of maintaining and
Google Chrome 129: Addressing Crucial Vulnerabilities and Enhancing Security
2 - 4 min read
Google Chrome remains the crown jewel in the browser market, with an impressive user base of approximately 3.45 billion. However, this immense
Defending Against Malicious Web Shells: Lessons from the Apache AXIS Server Attack
2 - 4 min read
Hackers have recently been observed actively targeting the Apache AXIS server to deploy malicious web shells, exposing significant vulnerabilities
Emerging Mallox Ransomware Variant Targets Linux Using Kryptina Code
3 - 5 min read
A new variant of the Mallox ransomware, which traditionally targeted Windows systems, has been observed targeting Linux environments. This
TeamTNT Hackers Attacking VPS Servers Running CentOS
3 - 5 min read
Security researchers have recently observed an alarming resurgence of TeamTNT , a notorious hacking group known for targeting cloud infrastructures.
Fighting Back Against Hadooken Malware by Strengthening WebLogic Security
2 - 4 min read
Cybercriminals have been relentlessly attacking the digital landscape, aiming to exploit vulnerabilities in well-known systems. One such exploit is

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved