RLSA-2026:97163: Moderate: mingw-glib2 security, bug fix, and enhancement update
GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.
Security Fix(es):
glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087)
glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal() (CVE-2026-58010)
glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetymd via invalid GDateTime (CVE-2026-58011)
glib: buffer over-read in gregexreplace() via glib/gregex.c:stringappend() and gutf8nextchar() (CVE-2026-58012)
glib: buffer over-read in glib/giochannel.c via "giochannelreadlinebackend" (CVE-2026-58013)
glib: off-by-one error in glib/gkeyfile.c via "gkeyfilegetlocalestringlist" (CVE-2026-58014)
glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyringlookupentry and mechanismclientdatareceive (CVE-2026-58015)
glib: integer underflow in gio/gdbusintrospection.c via "gdbusnodeinfonewforxml" (CVE-2026-58016)
Bug Fix(es) and Enhancement(s):
[mingw-glib2] cause qga command 'guest-ssh-get-authorized-keys' failed (JIRA:Rocky Linux-151748)
Rebase mingw-glib2 to 2.87.5 (JIRA:Rocky Linux-159874)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/mingw32-glib2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.89.2-1.el10 - Upgrade
Upgrade
rocky-linux/mingw32-glib2to a version that resolves this vulnerability.Fixed in 0:2.89.2-1.el10 - Upgrade
Upgrade
rocky-linux/mingw64-glib2to a version that resolves this vulnerability.Fixed in 0:2.89.2-1.el10 - Upgrade
Upgrade
rocky-linux/mingw32-glib2-staticto a version that resolves this vulnerability.Fixed in 0:2.89.2-1.el10 - Upgrade
Upgrade
rocky-linux/mingw64-glib2-debuginfoto a version that resolves this vulnerability.Fixed in 0:2.89.2-1.el10 - Upgrade
Upgrade
rocky-linux/mingw64-glib2-staticto a version that resolves this vulnerability.Fixed in 0:2.89.2-1.el10 - Upgrade
Upgrade
mingw-glib2to a version that resolves this vulnerability.Fixed in 2.87.5
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Rocky Linux packages are covered by this update?
The advisory lists mingw32-glib2, mingw64-glib2, their debuginfo packages, and their static packages.
Which reported issue is associated with path traversal?
CVE-2026-58015 is identified as a path traversal issue in GLib's D-Bus SHA-1 authentication handling, involving keyring_lookup_entry and mechanism_client_data_receive.
Are unauthenticated remote attacks represented in the advisory's severity vector?
Yes. The supplied CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating network reachability, low attack complexity, no required privileges, and no user interaction for the rated advisory.