Log in Start free

Vulnerability · Published Apr 7, 2025 · Assigned by redhat

CVE-2025-3360Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601().

Low 3.7

In plain English

A low-severity integer overflow in glib. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12glib2.02.74.6-2+deb12u6DEBIAN-CVE-2025-3360
Debian:13glib2.02.84.1-1DEBIAN-CVE-2025-3360
Debian:14glib2.02.84.1-1DEBIAN-CVE-2025-3360
Ubuntu:22.04:LTSglib2.02.72.4-0ubuntu2.7USN-7942-1
Ubuntu:22.04:LTSglib2.02.72.4-0ubuntu2.7UBUNTU-CVE-2025-3360
Ubuntu:24.04:LTSglib2.02.80.0-6ubuntu3.6USN-7942-1
Ubuntu:24.04:LTSglib2.02.80.0-6ubuntu3.6UBUNTU-CVE-2025-3360
Ubuntu:25.10glib2.02.86.0-2ubuntu0.1USN-7942-1

Affected products (as reported)

VendorProductVersions
glib 0 – before 2.82.5
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 6 see references
Red Hat Red Hat Enterprise Linux 7 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat Enterprise Linux 9 see references

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References