Skip to content

Commit 681371c

Browse files
azurelinux-securityazurelinux-security
authored
[AutoPR- Security] Patch glib for CVE-2025-14512, CVE-2025-14087 [MEDIUM] (#15293)
1 parent b97386f commit 681371c

7 files changed

Lines changed: 159 additions & 13 deletions

File tree

‎SPECS/glib/CVE-2025-14087.patch‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
From 487e062de90850689f14ca3d55cbdb9088d41bde Mon Sep 17 00:00:00 2001
2+
From: Philip Withnall <pwithnall@gnome.org>
3+
Date: Tue, 25 Nov 2025 19:02:56 +0000
4+
Subject: [PATCH] gvariant-parser: Fix potential integer overflow parsing
5+
(byte)strings
6+
7+
The termination condition for parsing string and bytestring literals in
8+
GVariant text format input was subject to an integer overflow for input
9+
string (or bytestring) literals longer than `INT_MAX`.
10+
11+
Fix that by counting as a `size_t` rather than as an `int`. The counter
12+
can never correctly be negative.
13+
14+
Spotted by treeplus. Thanks to the Sovereign Tech Resilience programme
15+
from the Sovereign Tech Agency. ID: #YWH-PGM9867-145
16+
17+
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
18+
Fixes: #3834
19+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
20+
Upstream-reference: https://gitlab.gnome.org/GNOME/glib/-/commit/3e72fe0fbb32c18a66486c4da8bc851f656af287.patch
21+
---
22+
glib/gvariant-parser.c | 10 +++++-----
23+
1 file changed, 5 insertions(+), 5 deletions(-)
24+
25+
diff --git a/glib/gvariant-parser.c b/glib/gvariant-parser.c
26+
index bb5238b..af6527d 100644
27+
--- a/glib/gvariant-parser.c
28+
+++ b/glib/gvariant-parser.c
29+
@@ -594,7 +594,7 @@ ast_resolve (AST *ast,
30+
{
31+
GVariant *value;
32+
gchar *pattern;
33+
- gint i, j = 0;
34+
+ size_t i, j = 0;
35+
36+
pattern = ast_get_pattern (ast, error);
37+
38+
@@ -1555,9 +1555,9 @@ string_free (AST *ast)
39+
* No leading/trailing space allowed. */
40+
static gboolean
41+
unicode_unescape (const gchar *src,
42+
- gint *src_ofs,
43+
+ size_t *src_ofs,
44+
gchar *dest,
45+
- gint *dest_ofs,
46+
+ size_t *dest_ofs,
47+
gsize length,
48+
SourceRef *ref,
49+
GError **error)
50+
@@ -1618,7 +1618,7 @@ string_parse (TokenStream *stream,
51+
gsize length;
52+
gchar quote;
53+
gchar *str;
54+
- gint i, j;
55+
+ size_t i, j;
56+
57+
token_stream_start_ref (stream, &ref);
58+
token = token_stream_get (stream);
59+
@@ -1748,7 +1748,7 @@ bytestring_parse (TokenStream *stream,
60+
gsize length;
61+
gchar quote;
62+
gchar *str;
63+
- gint i, j;
64+
+ size_t i, j;
65+
66+
token_stream_start_ref (stream, &ref);
67+
token = token_stream_get (stream);
68+
--
69+
2.45.4
70+

‎SPECS/glib/CVE-2025-14512.patch‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
From eaa4ef68c5ae930857e94f4c28c2fb3559b2660e Mon Sep 17 00:00:00 2001
2+
From: Philip Withnall <pwithnall@gnome.org>
3+
Date: Thu, 4 Dec 2025 16:37:19 +0000
4+
Subject: [PATCH] gfileattribute: Fix integer overflow calculating escaping for
5+
byte strings
6+
7+
The number of invalid characters in the byte string (characters which
8+
would have to be percent-encoded) was only stored in an `int`, which
9+
gave the possibility of a long string largely full of invalid
10+
characters overflowing this and allowing an attacker-controlled buffer
11+
size to be allocated.
12+
13+
This could be triggered by an attacker controlled file attribute (of
14+
type `G_FILE_ATTRIBUTE_TYPE_BYTE_STRING`), such as
15+
`G_FILE_ATTRIBUTE_THUMBNAIL_PATH` or `G_FILE_ATTRIBUTE_STANDARD_NAME`,
16+
being read by user code.
17+
18+
Spotted by Codean Labs.
19+
20+
Signed-off-by: Philip Withnall <pwithnall@gnome.org>
21+
22+
Fixes: #3845
23+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
24+
Upstream-reference: https://gitlab.gnome.org/GNOME/glib/-/commit/4f0399c0aaf3ffc86b5625424580294bc7460404.patch
25+
---
26+
gio/gfileattribute.c | 11 +++++++++--
27+
1 file changed, 9 insertions(+), 2 deletions(-)
28+
29+
diff --git a/gio/gfileattribute.c b/gio/gfileattribute.c
30+
index 8075d1d..b14e5fa 100644
31+
--- a/gio/gfileattribute.c
32+
+++ b/gio/gfileattribute.c
33+
@@ -20,6 +20,7 @@
34+
35+
#include "config.h"
36+
37+
+#include <stdint.h>
38+
#include <string.h>
39+
40+
#include "gfileattribute.h"
41+
@@ -271,11 +272,12 @@ valid_char (char c)
42+
return c >= 32 && c <= 126 && c != '\\';
43+
}
44+
45+
+/* Returns NULL on error */
46+
static char *
47+
escape_byte_string (const char *str)
48+
{
49+
size_t i, len;
50+
- int num_invalid;
51+
+ size_t num_invalid;
52+
char *escaped_val, *p;
53+
unsigned char c;
54+
const char hex_digits[] = "0123456789abcdef";
55+
@@ -293,7 +295,12 @@ escape_byte_string (const char *str)
56+
return g_strdup (str);
57+
else
58+
{
59+
- escaped_val = g_malloc (len + num_invalid*3 + 1);
60+
+ /* Check for overflow. We want to check the inequality:
61+
+ * !(len + num_invalid * 3 + 1 > SIZE_MAX) */
62+
+ if (num_invalid >= (SIZE_MAX - len) / 3)
63+
+ return NULL;
64+
+
65+
+ escaped_val = g_malloc (len + num_invalid * 3 + 1);
66+
67+
p = escaped_val;
68+
for (i = 0; i < len; i++)
69+
--
70+
2.45.4
71+

‎SPECS/glib/glib.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Low-level libraries useful for providing data structure handling for C.
33
Name: glib
44
Version: 2.71.0
5-
Release: 8%{?dist}
5+
Release: 9%{?dist}
66
License: LGPLv2+
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -17,6 +17,8 @@ Patch3: CVE-2025-3360.patch
1717
Patch4: CVE-2025-4373.patch
1818
Patch5: CVE-2025-7039.patch
1919
Patch6: CVE-2025-13601.patch
20+
Patch7: CVE-2025-14087.patch
21+
Patch8: CVE-2025-14512.patch
2022
BuildRequires: cmake
2123
BuildRequires: gtk-doc
2224
BuildRequires: libffi-devel
@@ -130,6 +132,9 @@ touch %{buildroot}%{_libdir}/gio/modules/giomodule.cache
130132
%doc %{_datadir}/gtk-doc/html/*
131133

132134
%changelog
135+
* Mon Dec 15 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.71.0-9
136+
- Patch for CVE-2025-14512, CVE-2025-14087
137+
133138
* Sat Nov 29 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.71.0-8
134139
- Patch for CVE-2025-13601
135140

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ libxml2-devel-2.10.4-9.cm2.aarch64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.aarch64.rpm
202-
glib-2.71.0-8.cm2.aarch64.rpm
202+
glib-2.71.0-9.cm2.aarch64.rpm
203203
libltdl-2.4.6-8.cm2.aarch64.rpm
204204
libltdl-devel-2.4.6-8.cm2.aarch64.rpm
205205
pcre-8.45-2.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -199,7 +199,7 @@ libxml2-devel-2.10.4-9.cm2.x86_64.rpm
199199
docbook-dtd-xml-4.5-11.cm2.noarch.rpm
200200
docbook-style-xsl-1.79.1-14.cm2.noarch.rpm
201201
libsepol-3.2-2.cm2.x86_64.rpm
202-
glib-2.71.0-8.cm2.x86_64.rpm
202+
glib-2.71.0-9.cm2.x86_64.rpm
203203
libltdl-2.4.6-8.cm2.x86_64.rpm
204204
libltdl-devel-2.4.6-8.cm2.x86_64.rpm
205205
pcre-8.45-2.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -101,11 +101,11 @@ gdbm-lang-1.21-1.cm2.aarch64.rpm
101101
gettext-0.21-3.cm2.aarch64.rpm
102102
gettext-debuginfo-0.21-3.cm2.aarch64.rpm
103103
gfortran-11.2.0-9.cm2.aarch64.rpm
104-
glib-2.71.0-8.cm2.aarch64.rpm
105-
glib-debuginfo-2.71.0-8.cm2.aarch64.rpm
106-
glib-devel-2.71.0-8.cm2.aarch64.rpm
107-
glib-doc-2.71.0-8.cm2.noarch.rpm
108-
glib-schemas-2.71.0-8.cm2.aarch64.rpm
104+
glib-2.71.0-9.cm2.aarch64.rpm
105+
glib-debuginfo-2.71.0-9.cm2.aarch64.rpm
106+
glib-devel-2.71.0-9.cm2.aarch64.rpm
107+
glib-doc-2.71.0-9.cm2.noarch.rpm
108+
glib-schemas-2.71.0-9.cm2.aarch64.rpm
109109
glibc-2.35-7.cm2.aarch64.rpm
110110
glibc-debuginfo-2.35-7.cm2.aarch64.rpm
111111
glibc-devel-2.35-7.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -106,11 +106,11 @@ gdbm-lang-1.21-1.cm2.x86_64.rpm
106106
gettext-0.21-3.cm2.x86_64.rpm
107107
gettext-debuginfo-0.21-3.cm2.x86_64.rpm
108108
gfortran-11.2.0-9.cm2.x86_64.rpm
109-
glib-2.71.0-8.cm2.x86_64.rpm
110-
glib-debuginfo-2.71.0-8.cm2.x86_64.rpm
111-
glib-devel-2.71.0-8.cm2.x86_64.rpm
112-
glib-doc-2.71.0-8.cm2.noarch.rpm
113-
glib-schemas-2.71.0-8.cm2.x86_64.rpm
109+
glib-2.71.0-9.cm2.x86_64.rpm
110+
glib-debuginfo-2.71.0-9.cm2.x86_64.rpm
111+
glib-devel-2.71.0-9.cm2.x86_64.rpm
112+
glib-doc-2.71.0-9.cm2.noarch.rpm
113+
glib-schemas-2.71.0-9.cm2.x86_64.rpm
114114
glibc-2.35-7.cm2.x86_64.rpm
115115
glibc-debuginfo-2.35-7.cm2.x86_64.rpm
116116
glibc-devel-2.35-7.cm2.x86_64.rpm

0 commit comments

Comments
 (0)