CVE-2024-52533

glib: buffer overflow in set_connect_msg()

Published Nov 11, 2024 CVSS 3.1 · 9.8 Critical EPSS 1.5% KEV · Not listed

Description

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR	cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::
	cpe:2.3:a:netapp:ontap_tools:10:::::vmware_vsphere::

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
mingw-glib2-0:2.78.6-2.el9	cpe:/a:redhat:enterprise_linux:9::crb	RHSA-2025:0936	2025-02-04T00:00:00Z

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-3962-1	glib2.0 security update
Ubuntu USN	USN-7114-1	GLib vulnerability

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.5% (1.507% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/11/12/11
https://cert-portal.siemens.com/productcert/html/ssa-089022.html
https://cert-portal.siemens.com/productcert/html/ssa-202008.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://gitlab.gnome.org/GNOME/glib/-/issues/3461
https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1
https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home
https://lists.debian.org/debian-lts-announce/2024/11/msg00020.html
https://nvd.nist.gov/vuln/detail/CVE-2024-52533
https://security.netapp.com/advisory/ntap-20241206-0009/
https://www.cve.org/CVERecord?id=CVE-2024-52533

History

Oct 15, 2026 1:30 AM Added references View changes

Type	Values Removed	Values Added
References		https://cert-portal.siemens.com/productcert/html/ssa-089022.html https://cert-portal.siemens.com/productcert/html/ssa-202008.html https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Jul 16, 2025 1:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00719}`	epss `{'score': 0.00553}`

Jun 17, 2025 1:45 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Debian Debian debian Linux Netapp Netapp active Iq Unified Manager Netapp ontap Tools
CPEs		cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere:: cpe:2.3:a:netapp:ontap_tools:10:::::vmware_vsphere:: cpe:2.3:o:debian:debian_linux:11.0:::::::*
Vendors & Products		Debian Debian debian Linux Netapp Netapp active Iq Unified Manager Netapp ontap Tools

Feb 13, 2025 12:45 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9::crb
Vendors & Products		Redhat Redhat enterprise Linux

Dec 6, 2024 2:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://security.netapp.com/advisory/ntap-20241206-0009/

Nov 23, 2024 9:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2024/11/msg00020.html

Nov 22, 2024 12:00 PM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2024/11/12/11

Nov 12, 2024 4:15 PM First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Gnome Gnome glib
Weaknesses		CWE-120
CPEs		cpe:2.3:a:gnome:glib::::::::
Vendors & Products		Gnome Gnome glib
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Nov 12, 2024 1:45 PM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		glib: buffer overflow in set_connect_msg()
Weaknesses		CWE-193
References		https://nvd.nist.gov/vuln/detail/CVE-2024-52533 https://www.cve.org/CVERecord?id=CVE-2024-52533
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H'}` threat_severity `Moderate`

Nov 11, 2024 11:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.
References		https://gitlab.gnome.org/GNOME/glib/-/issues/3461 https://gitlab.gnome.org/GNOME/glib/-/releases/2.82.1 https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home