-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 18 Aug 2025 09:27:51 +0100 Source: glib2.0 Binary: libglib2.0-0 libglib2.0-0-dbgsym libglib2.0-bin libglib2.0-bin-dbgsym libglib2.0-dev libglib2.0-dev-bin libglib2.0-dev-bin-dbgsym libglib2.0-tests libglib2.0-tests-dbgsym libglib2.0-udeb Architecture: mipsel Version: 2.74.6-2+deb12u7 Distribution: bookworm Urgency: medium Maintainer: mipsel Build Daemon (mipsel-osuosl-04) Changed-By: Simon McVittie Description: libglib2.0-0 - GLib library of C routines libglib2.0-bin - Programs for the GLib library libglib2.0-dev - Development files for the GLib library libglib2.0-dev-bin - Development utilities for the GLib library libglib2.0-tests - GLib library of C routines - installed tests libglib2.0-udeb - GLib library of C routines - minimal runtime (udeb) Closes: 1065022 1104930 1110640 1110696 Changes: glib2.0 (2.74.6-2+deb12u7) bookworm; urgency=medium . * d/p/gstring-carefully-handle-gssize-parameters.patch, d/p/gstring-Make-len_unsigned-unsigned.patch: Add patches from upstream to fix a buffer underflow in GString. This could cause a memory overwrite if a program handles extremely large text strings of an attacker-controlled length. The required string length would be close to 2 GiB on 32-bit and the bug is not believed to be practically feasible to exploit on 64-bit. (CVE-2025-4373) (Closes: #1104930) * d/p/glib-gfileutils.c-use-64-bits-for-value-in-get_tmp_file.patch, d/p/gfileutils-fix-computation-of-temporary-file-name.patch: Add patches from upstream to fix a buffer underflow in get_tmp_file(). This is used in g_mkstemp(), g_mkdtemp() and similar functions, and could cause a crash or possibly arbitrary file overwrites (believed to be unlikely to be exploitable in practice) if a long-running program creates more than 2 billion temporary files. (CVE-2025-7039) (Closes: #1110640) * d/libglib2.0-0.postrm.in: Rewrite postrm for safer upgrade behaviour, based on the version in unstable and proposed for inclusion in trixie: - Only remove giomodule.cache during purge, not during remove. This matches the behaviour of gschemas.compiled and avoids a window between old-postrm and new-postinst during which giomodule.cache is missing, breaking applications that need GIO modules. - Don't remove gschemas.compiled or giomodule.cache during purge if there is evidence that they might still be needed (Closes: #1065022, #1110696): + don't remove them if ${libdir}/glib-2.0 still exists, for example provided by libglib2.0-0t64 after upgrading to trixie; + don't remove gschemas.compiled if at least one GSettings schema still exists; + don't remove giomodule.cache if at least one GIO module still exists - Refactoring to support the above * d/tests/1065022-futureproofing: Add a test for #1065022, modified from the version in unstable and proposed for inclusion in trixie Checksums-Sha1: 032040797fc01621ffeb03177268918e41500954 11367 glib2.0_2.74.6-2+deb12u7_mipsel-buildd.buildinfo 25acc43da0e4d45b0dcd83b78d660837fe82b534 4079372 libglib2.0-0-dbgsym_2.74.6-2+deb12u7_mipsel.deb b8fd448e449d0e0f67af6fc6206211ef5d5dc177 1205736 libglib2.0-0_2.74.6-2+deb12u7_mipsel.deb e2d3f8ff19aaad4f133a13e5d1bfdeafa285ff0a 147340 libglib2.0-bin-dbgsym_2.74.6-2+deb12u7_mipsel.deb 77f77f584fe70ef79ea879637fc0f581a2022870 106148 libglib2.0-bin_2.74.6-2+deb12u7_mipsel.deb 74674237a851db85d07a0fa4c4f70ebf23ffe2a8 72756 libglib2.0-dev-bin-dbgsym_2.74.6-2+deb12u7_mipsel.deb 445c71f789f9d51bd3e8862c8c054b94ba52f7d6 150524 libglib2.0-dev-bin_2.74.6-2+deb12u7_mipsel.deb 9483411a6074020636880f1a52e4327273ca775c 1734360 libglib2.0-dev_2.74.6-2+deb12u7_mipsel.deb 9114df2374392d3e544c58cb8396f34562bb920b 4448604 libglib2.0-tests-dbgsym_2.74.6-2+deb12u7_mipsel.deb c6dea8d1b1acf55b4d0978be05c82368e9e19b57 1559448 libglib2.0-tests_2.74.6-2+deb12u7_mipsel.deb 6438730dc99219121f22148abfe11450e91628ec 2069464 libglib2.0-udeb_2.74.6-2+deb12u7_mipsel.udeb Checksums-Sha256: 6816a4d9cba1387edceb81a18960d132d55dd85c9fcb6faa50dff97d2a223185 11367 glib2.0_2.74.6-2+deb12u7_mipsel-buildd.buildinfo 960e5b3fa2ed2813fc95d2bf1b8b420c309191742e2348f551b65c829afdba13 4079372 libglib2.0-0-dbgsym_2.74.6-2+deb12u7_mipsel.deb c3beff725f28cd88441ad09a1986a9fec27820f58d74e74e4485437a699445b4 1205736 libglib2.0-0_2.74.6-2+deb12u7_mipsel.deb e7d0c71f8922ea19f77afcc77f034ec967898ab7c1e77b894e32181f02dee29d 147340 libglib2.0-bin-dbgsym_2.74.6-2+deb12u7_mipsel.deb e52df981d559a4e4a385f5e96a4be01c5c7d63675e8d2d7932a49167f5f1de42 106148 libglib2.0-bin_2.74.6-2+deb12u7_mipsel.deb e3effa01feb09a43684c42343c46ab1ed18c210f5ea6d16f46891d06ecd96aca 72756 libglib2.0-dev-bin-dbgsym_2.74.6-2+deb12u7_mipsel.deb 8399184bee8b77eb442e63608380fd798bef5b8156d61d0e571d58860b92de5a 150524 libglib2.0-dev-bin_2.74.6-2+deb12u7_mipsel.deb a3e9b4dfc3dfe85c6f2babba56ada6b6cecc23408286c8e7ab09d363197ce906 1734360 libglib2.0-dev_2.74.6-2+deb12u7_mipsel.deb 1ddf81aa208e37cce2a6b70e5dc4586f2a51d993bd72a832ffe0f86948a335bf 4448604 libglib2.0-tests-dbgsym_2.74.6-2+deb12u7_mipsel.deb 5a78a53e137fbbb12cda0339d12a9cf860d84667499aa604891b287d2b638b22 1559448 libglib2.0-tests_2.74.6-2+deb12u7_mipsel.deb 997eaec12c9941b5357b9958c6ad77ee50b74758bd1bf75b3aa23ebef25dab8b 2069464 libglib2.0-udeb_2.74.6-2+deb12u7_mipsel.udeb Files: 72ef9ac415731b4692f8889f03734174 11367 libs optional glib2.0_2.74.6-2+deb12u7_mipsel-buildd.buildinfo 79eb4092d2e2d4ffdd3afbda281019b1 4079372 debug optional libglib2.0-0-dbgsym_2.74.6-2+deb12u7_mipsel.deb 30e89a57fcea588ff9ef3840ef016dfd 1205736 libs optional libglib2.0-0_2.74.6-2+deb12u7_mipsel.deb 7e03fff6e1c39e33e00ccd6b31f62048 147340 debug optional libglib2.0-bin-dbgsym_2.74.6-2+deb12u7_mipsel.deb 0ba83dda9d4bc75ae238768d2f51ac5e 106148 misc optional libglib2.0-bin_2.74.6-2+deb12u7_mipsel.deb 3f3422decef64a563370e91856652143 72756 debug optional libglib2.0-dev-bin-dbgsym_2.74.6-2+deb12u7_mipsel.deb a8584922f195c8397ed5658b37be5aff 150524 libdevel optional libglib2.0-dev-bin_2.74.6-2+deb12u7_mipsel.deb 58e6fa8786f095bc6ec418358034464a 1734360 libdevel optional libglib2.0-dev_2.74.6-2+deb12u7_mipsel.deb 793ba14657fd0ab8a82b7727cd831889 4448604 debug optional libglib2.0-tests-dbgsym_2.74.6-2+deb12u7_mipsel.deb 8e87b217e01595508a1986292c07c7ee 1559448 libs optional libglib2.0-tests_2.74.6-2+deb12u7_mipsel.deb 8d93a75a072e283c24acaad00b2e0399 2069464 debian-installer optional libglib2.0-udeb_2.74.6-2+deb12u7_mipsel.udeb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERbXMbY9VMQqnSaVEV4aVsMglzVcFAmizaxoACgkQV4aVsMgl zVejxxAAxK/Ih/be3WFwt0oMVIb4UCXVB/kaWCEHJAq4CQNLSfutmwCBXDcbS4It vEHlHQ8+Z55PYzwaxjijrFWDxbA3DD24Bwf/FOfe+EMm9lt8VTb2eyoKIIaPM2BI +cci5648/9dY0XgS9xQoGRZcB4Qzdd18ld+AKTFz9ys6t8SfR85xG9xk5hnvXrb2 Wi02jrUrKWm7BZ+drbEvPvpqPsOktWcGDI750Tim5WxG6TWNDKxRUOY2SJodMzDw f56zXrh0rbd+V2AuFuetXK2NPhe+h7ig9clvJBiiNJ7nXGoKoFHHb0hxB+HxxHdU vxUL9eqUGDYmaGoyVyXUBZ1Y7YdHafuMUDbPOfS79k3Zr9U4AAeKfvIOY1VwoQGH 1wBSEEBD1mVe1baCHQ19eTBnxMFCb/JZ2WliaueCEyDNJvvBVwx0EzmZui8oa75m ASf4k/e0VdaTTGCIKgwTGe8ClfO+hY0vZeJ5XslsP2l7iRqyjTE8ALdDcmipomGn bgg+lQvUiLOQjsp4qUrcrBGqdD3hcyOxsY/9f4kc2AiSoAh8yr49JeXAp2cNm+/4 NHeLX76WuK3+qY5rEFZU4cXXZ58lOB2cX6/o/orDGIPT5Bi09oav4Q2Ro51H5OlG 4KQLOtpvVUCrSxnefO1FvC7GqazqeSnGz+pecthpCklgEIghVK8= =15o2 -----END PGP SIGNATURE-----