CVE catalog

CVE-2025-7039

GLib vulnerabilities

[CVE catalog]

Severity
Medium · CVSS 4.9CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.42% · Oct 25, 2026

A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianglib2.0sid2.90.1-2fixed
Debianglib2.0forky2.90.1-2fixed
Debianglib2.0trixie2.84.4-3~deb13u5fixed
Debianglib2.0bookworm2.74.6-2+deb12u9fixed
Debianglib2.0bookworm-security2.74.6-2+deb12u2vulnerable
Ubuntuglib2.0noble2.80.0-6ubuntu3.6fixed
Ubuntugir1.2-girepository-3.0noble2.80.0-6ubuntu3.6fixed
Ubuntugir1.2-girepository-3.0-devnoble2.80.0-6ubuntu3.6fixed
Ubuntugir1.2-glib-2.0noble2.80.0-6ubuntu3.6fixed
Ubuntugir1.2-glib-2.0-devnoble2.80.0-6ubuntu3.6fixed
Ubuntulibgirepository-2.0-0noble2.80.0-6ubuntu3.6fixed
Ubuntulibgirepository-2.0-devnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-0t64noble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-binnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-datanoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-devnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-dev-binnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-docnoble2.80.0-6ubuntu3.6fixed
Ubuntulibglib2.0-testsnoble2.80.0-6ubuntu3.6fixed
Ubuntuglib2.0pro2.62.1-1vulnerable
Ubuntuglib2.0pro2.63.1-2vulnerable
Ubuntuglib2.0pro2.63.1-2ubuntu1vulnerable
Ubuntuglib2.0pro2.63.3-1vulnerable
Ubuntuglib2.0pro2.63.3-3vulnerable
Ubuntuglib2.0pro2.63.5-2vulnerable
Ubuntuglib2.0pro2.64.0-1vulnerable
Ubuntuglib2.0pro2.64.1-1vulnerable
Ubuntuglib2.0pro2.64.2-1~fakesync1vulnerable
Ubuntuglib2.0pro2.64.3-1~ubuntu20.04.1vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.1vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.2vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.3vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.4vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.6vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.7vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.8vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.9vulnerable
Ubuntuglib2.0pro2.64.6-1~ubuntu20.04.9+esm1fixed
Ubuntuglib2.022.042.68.4-1ubuntu1vulnerable
Ubuntuglib2.022.042.70.1-1vulnerable
Ubuntuglib2.022.042.70.2-1vulnerable
Ubuntuglib2.022.042.71.0-2vulnerable
Ubuntuglib2.022.042.71.1-1vulnerable
Ubuntuglib2.022.042.71.2-1vulnerable
Ubuntuglib2.022.042.71.3-1vulnerable
Ubuntuglib2.022.042.72.0-1vulnerable
Ubuntuglib2.022.042.72.1-1vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu1vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.2vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.3vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.4vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.5vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.6vulnerable
Ubuntuglib2.022.042.72.4-0ubuntu2.7fixed
Ubuntuglib2.024.042.78.0-2vulnerable
Ubuntuglib2.024.042.78.1-4vulnerable
Ubuntuglib2.024.042.78.3-1vulnerable
Ubuntuglib2.024.042.78.3-2vulnerable
Ubuntuglib2.024.042.79.1-1vulnerable
Ubuntuglib2.024.042.79.2-1~ubuntu1vulnerable
Ubuntuglib2.024.042.79.3-3ubuntu5vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu1vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.1vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.2vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.4vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.5vulnerable
Ubuntuglib2.024.042.80.0-6ubuntu3.6fixed
Opensuseglib2tumbleweed2.84.4-1.1fixed
Suseglib2linux enterprise micro 5.32.70.5-150400.3.26.1fixed
Suseglib2linux enterprise micro 5.42.70.5-150400.3.26.1fixed
Suseglib2linux enterprise micro 5.52.70.5-150400.3.26.1fixed
Suseglib2linux micro 6.02.76.2-10.1fixed
Suseglib2linux micro 6.12.78.6-slfo.1.1_5.1fixed
Suseglib2linux enterprise server ltss extended security 12 sp52.48.2-12.49.1fixed
Suseglib2linux enterprise micro 5.22.62.6-150200.3.33.1fixed
Suseglib2linux enterprise module for basesystem 15 sp62.78.6-150600.4.22.1fixed
Suseglib2linux enterprise module for basesystem 15 sp72.78.6-150600.4.22.1fixed
Opensuseglib2leap 15.62.78.6-150600.4.22.1fixed
Opensuseglib2-docleap 15.62.78.6-150600.4.22.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianglib2.0sourcesid2.84.4-1not yet assignedNot reported[1110640]
Debianglib2.0sourceforky2.84.4-1not yet assignedNot reported[1110640]
Debianglib2.0sourcetrixie2.84.4-3~deb13u1not yet assignedNot reported[1110640]
Debianglib2.0sourcebookworm2.74.6-2+deb12u7not yet assignedNot reported[1110640]
Ubuntuglib2.0debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntugir1.2-girepository-3.0debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntugir1.2-girepository-3.0-devdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntugir1.2-glib-2.0debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntugir1.2-glib-2.0-devdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibgirepository-2.0-0debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibgirepository-2.0-devdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-0t64debnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-bindebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-datadebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-devdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-dev-bindebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-docdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntulibglib2.0-testsdebnoble2.80.0-6ubuntu3.6Not reportedNot reportedNot reported
Ubuntuglib2.0debpro2.64.6-1~ubuntu20.04.9+esm1Not reportedUBUNTU-CVE-2025-7039Not reported
Ubuntuglib2.0deb22.042.72.4-0ubuntu2.7Not reportedUBUNTU-CVE-2025-7039Not reported
Ubuntuglib2.0deb24.042.80.0-6ubuntu3.6Not reportedUBUNTU-CVE-2025-7039Not reported
Opensuseglib2rpmtumbleweed2.84.4-1.1Not reportedOPENSUSE-SU-2025:15432-1Not reported
Suseglib2rpmlinux enterprise micro 5.32.70.5-150400.3.26.1Not reportedSUSE-SU-2025:4347-1Not reported
Suseglib2rpmlinux enterprise micro 5.42.70.5-150400.3.26.1Not reportedSUSE-SU-2025:4347-1Not reported
Suseglib2rpmlinux enterprise micro 5.52.70.5-150400.3.26.1Not reportedSUSE-SU-2025:4347-1Not reported
Suseglib2rpmlinux micro 6.02.76.2-10.1Not reportedSUSE-SU-2025:21201-1Not reported
Suseglib2rpmlinux micro 6.12.78.6-slfo.1.1_5.1Not reportedSUSE-SU-2025:21063-1Not reported
Suseglib2rpmlinux enterprise server ltss extended security 12 sp52.48.2-12.49.1Not reportedSUSE-SU-2025:4278-1Not reported
Suseglib2rpmlinux enterprise micro 5.22.62.6-150200.3.33.1Not reportedSUSE-SU-2025:4186-1Not reported
Suseglib2rpmlinux enterprise module for basesystem 15 sp62.78.6-150600.4.22.1Not reportedSUSE-SU-2025:4308-1Not reported
Suseglib2rpmlinux enterprise module for basesystem 15 sp72.78.6-150600.4.22.1Not reportedSUSE-SU-2025:4308-1Not reported
Opensuseglib2rpmleap 15.62.78.6-150600.4.22.1Not reportedSUSE-SU-2025:4308-1Not reported
Opensuseglib2-docrpmleap 15.62.78.6-150600.4.22.1Not reportedSUSE-SU-2025:4308-1Not reported

[Debian bug #1110640]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libglib2.0-0]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • [libglib2.0-bin]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • [libglib2.0-data]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · all · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · all · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • [libglib2.0-dev]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • [libglib2.0-doc]Affected

    Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · all · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · all · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

  • Source package: [glib2.0]

    Details (4)
    • 2.74.6-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · amd64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

    • 2.74.6-2+deb12u2 · arm64 · bookworm-security

      Affected · Fixed: 2.74.6-2+deb12u7

      usn · glib2.0 · debian · bookworm; usn · glib2.0 · debian · 12

[openSUSE Tumbleweed]

  • Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-devel]Unknown

    Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-lang]Unknown

    Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · noarch · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [glib2-tools]Unknown

    Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libgio-2_0-0]Unknown

    Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • [libglib-2_0-0]Unknown

    Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

  • Source package: [glib2]

    Details (1)
    • 2.88.3-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 2.84.4-1.1

      Version impact unknown

      usn · glib2 · opensuse · tumbleweed

Next results

Observed:

References