* bsc#1224044 Cross-References: * CVE-2024-34397 . # Security update for glib2 Announcement ID: SUSE-SU-2024:1950-1 Rating: moderate References: * bsc#1224044 Cross-References: * CVE-2024-34397 CVSS scores: * CVE-2024-34397 ( SUSE ): 3.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N Affected Products: * Basesystem Module 15-SP6 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 An update that solves one vulnerability can now be installed. ## Description: This update for glib2 fixes the following issues: Update to version 2.78.6: * Fix a regression with IBus caused by the fix for CVE-2024-34397 Changes in version 2.78.5: * Fix CVE-2024-34397: GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing. (bsc#1224044) * Bugs fixed: * gvfs-udisks2-volume-monitor SIGSEGV in g_content_type_guess_for_tree() due to filename with bad encoding * gcontenttype: Make filename valid utf-8 string before processing. * gdbusconnection: Don't deliver signals if the sender doesn't match. Changes in version 2.78.4: * Bugs fixed: * Fix generated RST anchors for methods, signals and properties. * docs/reference: depend on a native gtk-doc. * gobject_gdb.py: Do not break bt on optimized build. * gregex: clean up usage of _GRegex.jit_status. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch SUSE-2024-1950=1 openSUSE-SLE-15.6-2024-1950=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2024-1950=1 ## Package List: * openSUSE Leap 15.6 (noarch) * gio-branding-upstream-2.78.6-150600.4.3.1 * gio-branding-SLE-15-150600.35.2.1 *glib2-lang-2.78.6-150600.4.3.1 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64 i586) * glib2-devel-debuginfo-2.78.6-150600.4.3.1 * glib2-tools-2.78.6-150600.4.3.1 * libgobject-2_0-0-debuginfo-2.78.6-150600.4.3.1 * libgthread-2_0-0-debuginfo-2.78.6-150600.4.3.1 * libgio-2_0-0-2.78.6-150600.4.3.1 * libgmodule-2_0-0-2.78.6-150600.4.3.1 * libglib-2_0-0-debuginfo-2.78.6-150600.4.3.1 * libgobject-2_0-0-2.78.6-150600.4.3.1 * glib2-tests-devel-debuginfo-2.78.6-150600.4.3.1 * glib2-devel-2.78.6-150600.4.3.1 * libglib-2_0-0-2.78.6-150600.4.3.1 * libgthread-2_0-0-2.78.6-150600.4.3.1 * glib2-tests-devel-2.78.6-150600.4.3.1 * glib2-debugsource-2.78.6-150600.4.3.1 * libgio-2_0-0-debuginfo-2.78.6-150600.4.3.1 * glib2-tools-debuginfo-2.78.6-150600.4.3.1 * libgmodule-2_0-0-debuginfo-2.78.6-150600.4.3.1 * glib2-devel-static-2.78.6-150600.4.3.1 * glib2-doc-2.78.6-150600.4.3.1 * openSUSE Leap 15.6 (x86_64) * glib2-devel-32bit-2.78.6-150600.4.3.1 * libgio-2_0-0-32bit-2.78.6-150600.4.3.1 * libgthread-2_0-0-32bit-2.78.6-150600.4.3.1 * libgobject-2_0-0-32bit-2.78.6-150600.4.3.1 * libgio-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 * libgobject-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 * glib2-devel-32bit-debuginfo-2.78.6-150600.4.3.1 * glib2-tools-32bit-2.78.6-150600.4.3.1 * glib2-tools-32bit-debuginfo-2.78.6-150600.4.3.1 * libgmodule-2_0-0-32bit-2.78.6-150600.4.3.1 * libglib-2_0-0-32bit-2.78.6-150600.4.3.1 * libgthread-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 * libglib-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 * libgmodule-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 * openSUSE Leap 15.6 (aarch64_ilp32) * glib2-devel-64bit-2.78.6-150600.4.3.1 * libgmodule-2_0-0-64bit-debuginfo-2.78.6-150600.4.3.1 * libglib-2_0-0-64bit-2.78.6-150600.4.3.1 * glib2-devel-64bit-debuginfo-2.78.6-150600.4.3.1 * libgio-2_0-0-64bit-2.78.6-150600.4.3.1 *libgthread-2_0-0-64bit-debuginfo-2.78.6-150600.4.3.1 * libglib-2_0-0-64bit-debuginfo-2.78.6-150600.4.3.1 * libgio-2_0-0-64bit-debuginfo-2.78.6-150600.4.3.1 * libgthread-2_0-0-64bit-2.78.6-150600.4.3.1 * glib2-tools-64bit-debuginfo-2.78.6-150600.4.3.1 * libgobject-2_0-0-64bit-2.78.6-150600.4.3.1 * libgobject-2_0-0-64bit-debuginfo-2.78.6-150600.4.3.1 * glib2-tools-64bit-2.78.6-150600.4.3.1 * libgmodule-2_0-0-64bit-2.78.6-150600.4.3.1 * Basesystem Module 15-SP6 (noarch) * gio-branding-SLE-15-150600.35.2.1 * glib2-lang-2.78.6-150600.4.3.1 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * glib2-devel-debuginfo-2.78.6-150600.4.3.1 * glib2-tools-2.78.6-150600.4.3.1 * libgobject-2_0-0-debuginfo-2.78.6-150600.4.3.1 * libgthread-2_0-0-debuginfo-2.78.6-150600.4.3.1 * libgio-2_0-0-2.78.6-150600.4.3.1 * libgmodule-2_0-0-2.78.6-150600.4.3.1 * libglib-2_0-0-debuginfo-2.78.6-150600.4.3.1 * libgobject-2_0-0-2.78.6-150600.4.3.1 * libglib-2_0-0-2.78.6-150600.4.3.1 * glib2-devel-2.78.6-150600.4.3.1 * libgthread-2_0-0-2.78.6-150600.4.3.1 * glib2-debugsource-2.78.6-150600.4.3.1 * libgio-2_0-0-debuginfo-2.78.6-150600.4.3.1 * glib2-tools-debuginfo-2.78.6-150600.4.3.1 * libgmodule-2_0-0-debuginfo-2.78.6-150600.4.3.1 * Basesystem Module 15-SP6 (x86_64) * libgio-2_0-0-32bit-2.78.6-150600.4.3.1 * libgobject-2_0-0-32bit-2.78.6-150600.4.3.1 * libgio-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 * libgobject-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 * libgmodule-2_0-0-32bit-2.78.6-150600.4.3.1 * libglib-2_0-0-32bit-2.78.6-150600.4.3.1 * libglib-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 * libgmodule-2_0-0-32bit-debuginfo-2.78.6-150600.4.3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-34397.html * https://bugzilla.suse.com/show_bug.cgi?id=1224044 . This patch resolves a significant vulnerability in libpng, mitigating the potential for buffer overflow attacks while introducingvarious improvements.. glib2 security patch,SUSE Linux updates,software vulnerabilities. . LinuxSecurity.com Team
Resolve CVE-2024-34397 (GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing), and also update gnome-shell to ensure this fix does not break the screencast feature.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-fd2569c4e9 2024-05-14 03:27:20.127802 -------------------------------------------------------------------------------- Name : gnome-shell Product : Fedora 39 Version : 45.6 Release : 2.fc39 URL : https://wiki.gnome.org/Projects/GnomeShell Summary : Window management and application launching for GNOME Description : GNOME Shell provides core user interface functions for the GNOME 3 desktop, like switching to windows and launching applications. GNOME Shell takes advantage of the capabilities of modern graphics hardware and introduces innovative user interface concepts to provide a visually attractive and easy to use experience. -------------------------------------------------------------------------------- Update Information: Resolve CVE-2024-34397 (GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing), and also update gnome-shell to ensure this fix does not break the screencast feature. -------------------------------------------------------------------------------- ChangeLog: * Tue May 7 2024 Michael Catanzaro - 45.6-2 - Fix screencast proxy bus name -------------------------------------------------------------------------------- References: [ 1 ] Bug #2279640 - CVE-2024-34397 glib2: Signal subscription vulnerabilities [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2279640 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-fd2569c4e9' at the command line. For more information, refer to the dnf documentation availableat http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Resolve CVE-2024-34397 (GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing), and also update gnome-shell to ensure this fix does not break the screencast feature.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-635a54eb7e 2024-05-12 04:16:43.337255 -------------------------------------------------------------------------------- Name : gnome-shell Product : Fedora 40 Version : 46.1 Release : 2.fc40 URL : https://wiki.gnome.org/Projects/GnomeShell Summary : Window management and application launching for GNOME Description : GNOME Shell provides core user interface functions for the GNOME 3 desktop, like switching to windows and launching applications. GNOME Shell takes advantage of the capabilities of modern graphics hardware and introduces innovative user interface concepts to provide a visually attractive and easy to use experience. -------------------------------------------------------------------------------- Update Information: Resolve CVE-2024-34397 (GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing), and also update gnome-shell to ensure this fix does not break the screencast feature. -------------------------------------------------------------------------------- ChangeLog: * Tue May 7 2024 Michael Catanzaro - 46.1-2 - Fix screencast proxy bus name -------------------------------------------------------------------------------- References: [ 1 ] Bug #2279637 - CVE-2024-34397 glib2: Signal subscription vulnerabilities [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2279637 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-635a54eb7e' at the command line. For more information, refer to the dnf documentation availableat http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Resolve CVE-2024-34397 (GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing), and also update gnome-shell to ensure this fix does not break the screencast feature.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-635a54eb7e 2024-05-12 04:16:43.337255 -------------------------------------------------------------------------------- Name : glib2 Product : Fedora 40 Version : 2.80.2 Release : 1.fc40 URL : https://www.gtk.org Summary : A library of handy utility functions Description : GLib is the low-level core library that forms the basis for projects such as GTK+ and GNOME. It provides data structure handling for C, portability wrappers, and interfaces for such runtime functionality as an event loop, threads, dynamic loading, and an object system. -------------------------------------------------------------------------------- Update Information: Resolve CVE-2024-34397 (GDBus signal subscriptions for well-known names are vulnerable to unicast spoofing), and also update gnome-shell to ensure this fix does not break the screencast feature. -------------------------------------------------------------------------------- ChangeLog: * Thu May 9 2024 Michael Catanzaro - 2.80.2-1 - Update to 2.80.2 * Tue May 7 2024 Michael Catanzaro - 2.80.1-1 - Update to 2.80.1 * Thu Apr 18 2024 Michael Catanzaro - 2.80.0-2 - Add missing bundled provides -------------------------------------------------------------------------------- References: [ 1 ] Bug #2279637 - CVE-2024-34397 glib2: Signal subscription vulnerabilities [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2279637 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-635a54eb7e' at the command line. For more information, refer to thednf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.