Affected: AlmaLinux:10: glib2, AlmaLinux:10: glib2-devel, AlmaLinux:10: glib2-doc, AlmaLinux:10: glib2-static, AlmaLinux:10: glib2-tests

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

* xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

Affected: openEuler:24.03-LTS-SP4: glib2

GLib is a bundle of three (formerly five) low-level system libraries written in C and developed mainly by GNOME. GLib's code was separated from GTK, so it can be used by software other than GNOME and has been developed in parallel ever since. Security Fix(es):

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.(CVE-2026-16118)

xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

perl: Perl: Incorrect regular expression processing via large regular expressions openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server openssl: RPK server signature algorithm selection can dereference a missing certificate xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c openssl: QUIC server may trigger double free when processing INITIAL packet vim: Vim: Information disclosure and denial of service via crafted Unicode characters in terminal emulator lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking vim: Vim: Denial of Service via out-of-bounds write in terminal handling openssl: excessive memory use buffering DTLS records for a future epoch vim: Vim: Denial of Service via crafted spell file expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding openssl: heap buffer overflow in CMS key unwrapping openssl: untrusted sender DN used as format string in CMP response validation openssl: CMP indefinite cache growth of ExtraCerts openssl: QUIC ACK-only packet retention can cause memory exhaustion openssl: invalid pointer dereference in CMP server via crafted protectionAlg vim: Vim: Heap buffer overflow allows arbitrar…

Affected: Rocky Linux:10: glib2

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

Security Fix(es):

* xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (CVE-2026-16118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Ubuntu:Pro:14.04:LTS: glib2.0, Ubuntu:Pro:16.04:LTS: glib2.0, Ubuntu:Pro:18.04:LTS: glib2.0, Ubuntu:Pro:20.04:LTS: glib2.0, Ubuntu:22.04:LTS: glib2.0, Ubuntu:24.04:LTS: glib2.0, Ubuntu:26.04:LTS: glib2.0

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen oder Code auszuführen.