CVE-2025-60019 — Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c v…

CVE-2025-60019

Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based() PUBLISHED

Description (CNA)

glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 2.60 before 2.80.2
Red Hat / Red Hat Enterprise Linux 10	unaffected
Red Hat / Red Hat Enterprise Linux 6	unaffected
Red Hat / Red Hat Enterprise Linux 7	unaffected
Red Hat / Red Hat Enterprise Linux 8	unaffected
Red Hat / Red Hat Enterprise Linux 9	unaffected

CWE

CWE-476

References

https://access.redhat.com/security/cve/CVE-2025-60019
https://bugzilla.redhat.com/show_bug.cgi?id=2398140
https://gitlab.gnome.org/GNOME/glib-networking/-/issues/227

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.