Debian dla-4491 : libglib2.0-0 - security update

low Nessus Plugin ID 299773

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4491 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4491-1 [email protected] https://www.debian.org/lts/security/ Andreas Henriksson February 23, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : glib2.0 Version : 2.66.8-1+deb11u8 CVE ID : CVE-2026-0988 CVE-2026-1484 CVE-2026-1485 CVE-2026-1489 Debian Bug : 1125752 1126549 1126550 1126551

Multiple issues were found in GLib, a general-purpose, portable utility library, that could lead to denial of service, memory corruption or potentially arbitrary code execution if maliciously crafted data is processed.

CVE-2026-0988

Codean Labs found missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).

CVE-2026-1484

treeplus with additional thanks to Sovereign Tech Resilience program of the Sovereign Tech Agency found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries.
This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.

CVE-2026-1485

treeplus with additonal thanks to Sovereign Tech Resilience program of the Sovereign Tech Agency found a flaw in Glib's content type parsing logic.
This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.

CVE-2026-1489

treeplus with additional thanks to Sovereign Tech Resilience program of the Sovereign Tech Agency found a flaw n GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.

For Debian 11 bullseye, these problems have been fixed in version 2.66.8-1+deb11u8.

We recommend that you upgrade your glib2.0 packages.

For the detailed security status of glib2.0 please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/glib2.0

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libglib2.0-0 packages.

Plugin Details

Severity: Low

ID: 299773

File Name: debian_DLA-4491.nasl

Version: 1.1

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 2/23/2026

Updated: 2/23/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.3

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2026-1489

CVSS v3

Risk Factor: Low

Base Score: 2.8

Temporal Score: 2.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-1485

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:libglib2.0-doc, p-cpe:/a:debian:debian_linux:libglib2.0-data, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:libglib2.0-dev, p-cpe:/a:debian:debian_linux:libglib2.0-udeb, p-cpe:/a:debian:debian_linux:libglib2.0-bin, p-cpe:/a:debian:debian_linux:libglib2.0-tests, p-cpe:/a:debian:debian_linux:libglib2.0-0, p-cpe:/a:debian:debian_linux:libglib2.0-dev-bin

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 2/23/2026

Vulnerability Publication Date: 1/17/2026

Reference Information

CVE: CVE-2026-0988, CVE-2026-1484, CVE-2026-1485, CVE-2026-1489

Detections

Analytics