Homepage

Improper Verification of Source of a Communication Channel The advisory has been revoked - it doesn't affect any version of package glib2  (opens in a new tab)

Threat Intelligence

EPSS
0.76% (54th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-GLIB2-9368906
  • published8 Mar 2025
  • disclosed7 May 2024
Report a new vulnerability Found a mistake?

Introduced: 7 May 2024

CVE-2024-34397  (opens in a new tab)
CWE-940  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream glib2 package and not the glib2 package as distributed by RHEL.

An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.

References