CVE-2025-60019: Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()
Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via gtlsbionewfromiostream() and gtlsbionewfromdatagrambased()
Other sources
glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60019?
CVE-2025-60019 is considered a moderate severity vulnerability due to potential out-of-bounds memory access.
How do I fix CVE-2025-60019?
To mitigate CVE-2025-60019, ensure that you are using the latest version of the GNOME glib-networking software with the appropriate patches applied.
What systems are affected by CVE-2025-60019?
CVE-2025-60019 affects the GNOME glib-networking software that utilizes OpenSSL for network communication.
What are the potential consequences of CVE-2025-60019?
The potential consequences of CVE-2025-60019 include crashing applications or arbitrary code execution due to invalid memory write operations.
Is there a workaround for CVE-2025-60019?
As a temporary workaround for CVE-2025-60019, consider disabling the OpenSSL backend in glib-networking until an official fix is released.