← All notices | Source (USN-8794-1) | Text version

QSN-8794-1: GLib vulnerabilities

September 21, 2026

Summary

GLib could be made to crash or expose sensitive information if it received specially crafted input.

Details

It was discovered that GLib's GDBus authentication mechanism failed to enforce length limitations on data lines read from a client. An unauthenticated attacker could exploit this to cause a denial of service via resource exhaustion. (CVE-2026-15588)

It was discovered that the xdgmime library in GLib had a heap-based buffer overflow. An attacker-controlled MIME magic file could cause an out-of-bounds write on little-endian systems. (CVE-2026-16118)

It was discovered that GLib had an off-by-one error in the GVariant serialiser. An attacker could use this to cause an out-of-bounds read, leading to information disclosure or a denial of service. (CVE-2026-58010)

It was discovered that GLib had an out-of-bounds read in GDateTime. An attacker could use this to corrupt date output and cause a denial of service. (CVE-2026-58011)

It was discovered that GLib's g_regex_replace() function had a buffer over-read when used with the G_REGEX_RAW flag. An attacker could use this to cause information disclosure or a denial of service. (CVE-2026-58012)

It was discovered that GLib's GIOChannel had a buffer over-read when using a custom line terminator. An attacker could use this to cause information disclosure or a denial of service. (CVE-2026-58013)

It was discovered that GLib's GKeyFile had an off-by-one error when loading a key file with an empty value. An attacker could use this to cause an out-of-bounds access or a denial of service. (CVE-2026-58014)

It was discovered that GLib's DBUS_COOKIE_SHA1 authentication mechanism failed to validate the cookie_context parameter. A malicious D-Bus server could use this to read arbitrary files from the client. (CVE-2026-58015)

It was discovered that GLib's D-Bus introspection XML parser had a state confusion issue. An attacker could use this to cause an out-of-bounds read and denial of service. (CVE-2026-58016)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.102.72.4-0ubuntu2.10Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.102.72.4-0ubuntu2.10Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.9.0.464Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.102.72.4-0ubuntu2.10Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.102.72.4-0ubuntu2.10Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibglib2.0-0Internally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibglib2.0-binInternally-facing2.72.4-0ubuntu2.92.72.4-0ubuntu2.10Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibglib2.0-dataInternally-facing2.72.4-0ubuntu2.32.72.4-0ubuntu2.10Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-58013, CVE-2026-58016, CVE-2026-58011, CVE-2026-58015, CVE-2026-58012, CVE-2026-58010, CVE-2026-16118, CVE-2026-58014, CVE-2026-15588

References

https://ubuntu.com/security/notices/USN-8794-1

https://nvd.nist.gov/vuln/detail/CVE-2026-58013

https://nvd.nist.gov/vuln/detail/CVE-2026-58016

https://nvd.nist.gov/vuln/detail/CVE-2026-58011

https://nvd.nist.gov/vuln/detail/CVE-2026-58015

https://nvd.nist.gov/vuln/detail/CVE-2026-58012

https://nvd.nist.gov/vuln/detail/CVE-2026-58010

https://nvd.nist.gov/vuln/detail/CVE-2026-16118

https://nvd.nist.gov/vuln/detail/CVE-2026-58014

https://nvd.nist.gov/vuln/detail/CVE-2026-15588

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bionicglib2.02.56.4-0ubuntu0.18.04.9+esm6
Ubuntu 20.04 LTSglib2.02.64.6-1~ubuntu20.04.9+esm2
Ubuntu 22.04 LTSglib2.02.72.4-0ubuntu2.10
Ubuntu 24.04 LTSglib2.02.80.0-6ubuntu3.9
resoluteglib2.02.88.0-1ubuntu0.1
trustyglib2.02.40.2-0ubuntu1.1+esm8
xenialglib2.02.48.2-0ubuntu4.8+esm6