CVE-2025-7039
Fixed in a distro release EPSS <1%CVSS 3.7
A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.
Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Siemens RUGGEDCOM RST2428P
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | glib2.0 | 2.66.8-1+deb11u7 |
| Debian 12 | glib2.0 | 2.74.6-2+deb12u7 |
| Debian 13 | glib2.0 | 2.84.4-3~deb13u1 |
| Debian 14 | glib2.0 | 2.84.4-1 |
| Red Hat hummingbird 1 | glib2 | 0:2.88.0-1.1.hum1 |
| Red Hat hummingbird 1 | glib2-devel | 0:2.88.0-1.1.hum1 |
| Red Hat hummingbird 1 | glib2-doc | 0:2.88.0-1.1.hum1 |
| Red Hat hummingbird 1 | glib2-static | 0:2.88.0-1.1.hum1 |
| Red Hat hummingbird 1 | glib2-tests | 0:2.88.0-1.1.hum1 |
| SUSE Linux Enterprise Micro 5.2 | glib2 | 2.62.6-150200.3.33.1 |
| SUSE Linux Enterprise Micro 5.3 | glib2 | 2.70.5-150400.3.26.1 |
| SUSE Linux Enterprise Micro 5.4 | glib2 | 2.70.5-150400.3.26.1 |
| SUSE Linux Enterprise Micro 5.5 | glib2 | 2.70.5-150400.3.26.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | glib2 | 2.78.6-150600.4.22.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | glib2 | 2.78.6-150600.4.22.1 |
| SUSE Linux Enterprise Server 16.0 | glib2 | 2.84.4-160000.1.1 |
| SUSE Linux Enterprise Server 16.0 | glib2-branding-SLE | 16-160000.2.2 |
| SUSE Linux Enterprise Server 16.0 | glib2-doc | 2.84.4-160000.1.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | glib2 | 2.48.2-12.49.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | glib2 | 2.84.4-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | glib2-branding-SLE | 16-160000.2.2 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | glib2-doc | 2.84.4-160000.1.1 |
| SUSE Linux Micro 6.0 | glib2 | 2.76.2-10.1 |
| SUSE Linux Micro 6.1 | glib2 | 2.78.6-slfo.1.1_5.1 |
| SUSE Linux Micro 6.2 | glib2 | 2.84.4-160000.1.1 |
| SUSE Linux Micro 6.2 | glib2-branding-SLE | 16-160000.2.2 |
| Ubuntu 22.04 LTS | glib2.0 | 2.72.4-0ubuntu2.7 |
| Ubuntu 24.04 LTS | glib2.0 | 2.80.0-6ubuntu3.6 |
| Ubuntu 25.10 | glib2.0 | 2.86.0-2ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | glib2.0 | 2.40.2-0ubuntu1.1+esm7 |
| Ubuntu Pro 16.04 LTS | glib2.0 | 2.48.2-0ubuntu4.8+esm5 |
| Ubuntu Pro 18.04 LTS | glib2.0 | 2.56.4-0ubuntu0.18.04.9+esm5 |
| Ubuntu Pro 20.04 LTS | glib2.0 | 2.64.6-1~ubuntu20.04.9+esm1 |
| openSUSE Leap 15.6 | glib2 | 2.78.6-150600.4.22.1 |
| openSUSE Leap 15.6 | glib2-doc | 2.78.6-150600.4.22.1 |
| openSUSE Leap 16.0 | glib2 | 2.84.4-160000.1.1 |
| openSUSE Leap 16.0 | glib2-doc | 2.84.4-160000.1.1 |
| openSUSE Tumbleweed | glib2 | 2.84.4-1.1 |