Re: [OE-core] [scarthgap][PATCH] glib-2.0: fix CVE-2026-58016

["Yoann Congal" <yoann.congal@smile.fr>]

On Fri Jul 3, 2026 at 3:46 PM CEST, Benjamin Robin wrote:
> Hello Yoann,
>
> On Friday, July 3, 2026 at 3:33 PM, Yoann Congal wrote:
>> On Fri Jul 3, 2026 at 3:25 PM CEST, Benjamin Robin via lists.openembedded.org wrote:
>> > A flaw was found in GLib. A state confusion issue exists in
>> > g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when
>> > processing malformed D-Bus introspection XML, specifically with a <node>
>> > element nested within other elements like <method>, <signal>, <property>
>> > or <arg>. This issue can cause an unsigned integer overflow and lead to an
>> > out-of-bounds read, resulting in a denial of service.
>> >
>> > Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
>> > ---
>> >  .../glib-2.0/glib-2.0/CVE-2026-58016-1.patch       | 92 +++++++++++++++++++++
>> >  .../glib-2.0/glib-2.0/CVE-2026-58016-2.patch       | 96 ++++++++++++++++++++++
>> >  meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb      |  2 +
>> 
>> NVD tells this is fixed in 2.88.1 but wrynose is at 2.88.0. Can you send
>> a patch for wrynose so I can accept this on scarthgap?
>
> The fun thing, that this is not fixed in version 2.88.1 but in 2.89.0.

Then,
* NVD is wrong(?). Can you send a modification request so we avoid false
  negatives (those are the worst ones!)
* And, in that case, master is also impacted and need a fix.

Thanks!

> I am sending a patch right now.
>
>> 
>> Thanks!
>> 


-- 
Yoann Congal
Smile ECS