Buffer overflow in Glib
CVE-2023-32643
A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (27.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 27.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: -0.000
Affected products
- Glib — versions 2.75.1
- GNOME Glib
Weakness classification (CWE)
Public proof-of-concept exploits
References
- gitlab.gnome.org/GNOME/glib/-/issues/2840 (Issue Tracking, Vendor Advisory)
- https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-… (Broken Link)
- security.netapp.com/advisory/ntap-20240426-0005/
Frequently asked questions
- What is CVE-2023-32643?
- CVE-2023-32643 is a medium-severity vulnerability in Glib, classified under Heap-based Buffer Overflow. CVSS score: 5.3/10. Published 2023-09-14.
- How severe is CVE-2023-32643?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2023-32643 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.