CVE-2023-32665: Gvariant deserialisation does not match spec for non-normal data

Q: What is CVE-2023-32665?

CVE-2023-32665 is a vulnerability found in GLib where GVariant deserialization is vulnerable to an exponential blowup issue.

Q: What is the severity of CVE-2023-32665?

CVE-2023-32665 has a severity rating of medium.

Q: How does CVE-2023-32665 affect GLib?

CVE-2023-32665 affects GLib versions up to and excluding 2.74.4.

Q: How can CVE-2023-32665 be exploited?

CVE-2023-32665 can be exploited by using a crafted GVariant to cause excessive processing, leading to denial of service.

Q: Is there a fix available for CVE-2023-32665?

Yes, updating GLib to version 2.74.4 or later will fix CVE-2023-32665.

Published Dec 14, 2022

Updated

A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

Other sources

GLib's GVariant deserialization prior to GLib 2.74.4 is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

References: https://gitlab.gnome.org/GNOME/glib/-/issues/2121

— Red Hat

Gvariant deserialisation does not match spec for non-normal data

— Microsoft

Affected Software

10 affected componentsFixes available

ubuntu/glib2.0<2.64.6-1~ubuntu20.04.6

2.64.6-1~ubuntu20.04.6

ubuntu/glib2.0<2.72.4-0ubuntu2.2

2.72.4-0ubuntu2.2

ubuntu/glib2.0<2.74.3-0ubuntu1.2

2.74.3-0ubuntu1.2

ubuntu/glib2.0<2.75.1, <2.74.4

2.75.12.74.4

ubuntu/glib2.0<2.56.4-0ubuntu0.18.04.9+

2.56.4-0ubuntu0.18.04.9+

ubuntu/glib2.0<2.40.2-0ubuntu1.1+

2.40.2-0ubuntu1.1+

ubuntu/glib2.0<2.48.2-0ubuntu4.8+

2.48.2-0ubuntu4.8+

debian/glib2.0<=2.58.3-2+deb10u3

2.58.3-2+deb10u52.66.8-1+deb11u12.74.6-22.78.4-12.78.4-3

Gnome GLib<2.74.4

Microsoft cbl2 glib 2.71.0-4

Patch available

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/glib2.0 to a version that resolves this vulnerability.
Fixed in 2.64.6-1~ubuntu20.04.6
Upgrade
Upgrade ubuntu/glib2.0 to a version that resolves this vulnerability.
Fixed in 2.72.4-0ubuntu2.2
Upgrade
Upgrade ubuntu/glib2.0 to a version that resolves this vulnerability.
Fixed in 2.74.3-0ubuntu1.2
Upgrade
Upgrade ubuntu/glib2.0 to a version that resolves this vulnerability.
Fixed in 2.75.1Fixed in 2.74.4
Upgrade
Upgrade ubuntu/glib2.0 to a version that resolves this vulnerability.
Fixed in 2.56.4-0ubuntu0.18.04.9+
Upgrade
Upgrade ubuntu/glib2.0 to a version that resolves this vulnerability.
Fixed in 2.40.2-0ubuntu1.1+
Upgrade
Upgrade ubuntu/glib2.0 to a version that resolves this vulnerability.
Fixed in 2.48.2-0ubuntu4.8+
Upgrade
Upgrade debian/glib2.0 to a version that resolves this vulnerability.
Fixed in 2.58.3-2+deb10u5Fixed in 2.66.8-1+deb11u1Fixed in 2.74.6-2Fixed in 2.78.4-1Fixed in 2.78.4-3

Event History

Dec 14, 2022

CVE Published

12:00 AM

Data Sourced

12:00 AM

RemedyDescriptionSeverityWeakness

Jun 2, 2023

Data Sourced

via Red Hat·07:13 AM

DescriptionSeverityAffected Software

Sep 14, 2023

CVE Published

via MITRE·07:03 PM

Data Sourced

via MITRE·07:03 PM

DescriptionSeverityWeakness

Jan 12, 2024

Data Sourced

via Launchpad·12:20 AM

Description

Oct 1, 2025

Data Sourced

via Microsoft·11:11 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·11:11 PM

Affected Software

Updated

via Microsoft·11:11 PM

DescriptionSeverity

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2023-32665?

CVE-2023-32665 is a vulnerability found in GLib where GVariant deserialization is vulnerable to an exponential blowup issue.

What is the severity of CVE-2023-32665?

CVE-2023-32665 has a severity rating of medium.

How does CVE-2023-32665 affect GLib?

CVE-2023-32665 affects GLib versions up to and excluding 2.74.4.

How can CVE-2023-32665 be exploited?

CVE-2023-32665 can be exploited by using a crafted GVariant to cause excessive processing, leading to denial of service.

Is there a fix available for CVE-2023-32665?

Yes, updating GLib to version 2.74.4 or later will fix CVE-2023-32665.

CVE-2023-32665: Gvariant deserialisation does not match spec for non-normal data

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is CVE-2023-32665?

What is the severity of CVE-2023-32665?

How does CVE-2023-32665 affect GLib?

How can CVE-2023-32665 be exploited?

Is there a fix available for CVE-2023-32665?

Company

Resources

Contact