CVE-2025-6052
Fixed in a distro release EPSS <1%CVSS 3.7
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn’t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Siemens RUGGEDCOM RST2428P, Siemens SIMATIC CN 4100
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | glib2 | 2.82.2-766.amzn2023 |
| Amazon Linux 2023 | glib2-devel | 2.82.2-766.amzn2023 |
| Amazon Linux 2023 | glib2-doc | 2.82.2-766.amzn2023 |
| Amazon Linux 2023 | glib2-static | 2.82.2-766.amzn2023 |
| Amazon Linux 2023 | glib2-tests | 2.82.2-766.amzn2023 |
| Chainguard | openjdk-11-openj9 | 0.59.0-r2 |
| Chainguard | openjdk-11-openj9-dbg | 0.59.0-r2 |
| Chainguard | openjdk-11-openj9-default-jdk | 0.59.0-r2 |
| Chainguard | openjdk-11-openj9-default-jvm | 0.59.0-r2 |
| Chainguard | openjdk-11-openj9-doc | 0.59.0-r2 |
| Chainguard | openjdk-11-openj9-jmods | 0.59.0-r2 |
| Chainguard | openjdk-11-openj9-jre | 0.59.0-r2 |
| Chainguard | openjdk-17-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-17-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-17-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-17-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-17-openj9-doc | 0.59.0-r1 |
| Chainguard | openjdk-17-openj9-jmods | 0.59.0-r1 |
| Chainguard | openjdk-17-openj9-jre | 0.59.0-r1 |
| Chainguard | openjdk-21-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-21-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-21-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-21-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-21-openj9-doc | 0.59.0-r1 |
| Chainguard | openjdk-21-openj9-jmods | 0.59.0-r1 |
| Chainguard | openjdk-21-openj9-jre | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-jmods | 0.59.0-r1 |
| Chainguard | openjdk-25-openj9-jre | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-jmods | 0.59.0-r1 |
| Chainguard | openjdk-26-openj9-jre | 0.59.0-r1 |
| Chainguard | openjdk-8-openj9 | 0.59.0-r1 |
| Chainguard | openjdk-8-openj9-dbg | 0.59.0-r1 |
| Chainguard | openjdk-8-openj9-default-jdk | 0.59.0-r1 |
| Chainguard | openjdk-8-openj9-default-jvm | 0.59.0-r1 |
| Chainguard | openjdk-8-openj9-doc | 0.59.0-r1 |
| Chainguard | openjdk-8-openj9-jre | 0.59.0-r1 |
| Debian 13 | glib2.0 | 2.84.3-1 |
| Debian 14 | glib2.0 | 2.84.3-1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | glib2 | 2.78.6-150600.4.16.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | glib2 | 2.78.6-150600.4.16.1 |
| SUSE Linux Micro 6.0 | glib2 | 2.76.2-9.1 |
| SUSE Linux Micro 6.1 | glib2 | 2.78.6-slfo.1.1_4.1 |
| Ubuntu 22.04 LTS | glib2.0 | 2.72.4-0ubuntu2.7 |
| Ubuntu 24.04 LTS | glib2.0 | 2.80.0-6ubuntu3.6 |
| Ubuntu 25.10 | glib2.0 | 2.86.0-2ubuntu0.1 |
| openSUSE Leap 15.6 | glib2 | 2.78.6-150600.4.16.1 |
| openSUSE Leap 15.6 | glib2-doc | 2.78.6-150600.4.16.1 |
| openSUSE Tumbleweed | glib2 | 2.84.3-1.1 |