CVE-2023-32665

MediumCVSS 5.5/10Last modified Oct 15, 2026

Description

A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-502

Affected software

Vendor	Product	Versions
n/a	glib2	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Fedora	Fedora 38	—
Fedora	Extra Packages for Enterprise Linux	—
Fedora	Fedora	—
Fedora	Fedora 37	—
Fedora	Fedora 38	—
Fedora	Fedora 37	—
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	>= V3.1.0, < V3.1.5
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	>= V3.1.0, < V3.1.5

References

https://access.redhat.com/security/cve/CVE-2023-32665Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2211827Issue Tracking, Third Party Advisory
https://gitlab.gnome.org/GNOME/glib/-/issues/2121Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html
https://security.gentoo.org/glsa/202311-18
https://security.netapp.com/advisory/ntap-20240426-0006/
https://access.redhat.com/security/cve/CVE-2023-32665Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2211827Issue Tracking, Third Party Advisory
https://gitlab.gnome.org/GNOME/glib/-/issues/2121Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html
https://security.gentoo.org/glsa/202311-18
https://security.netapp.com/advisory/ntap-20240426-0006/
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Timeline

Published: Sep 14, 2023
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-326667.2On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or CVE-2023-326685.5LuaTeX before 1.17.0 allows a document (compiled with the default settings) to make arbitrary network requests. This occurs because full acc CVE-2023-326695.4Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and ren CVE-2023-32678.8When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passe CVE-2023-326705.4Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a mal CVE-2023-326715.4A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a ma CVE-2023-326724.3An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated CVE-2023-326739.8Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable t CVE-2023-326749.8Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow.CVE-2023-326755.3Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, i CVE-2023-326767.2Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install a CVE-2023-326773.1Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can