Vulnerability · Published Apr 7, 2025 · Assigned by redhat
CVE-2025-3360Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp with g_date_time_new_from_iso8601().
Low 3.7
In plain English
A low-severity integer overflow in glib. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.7%top 48.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | glib2.0 | 2.74.6-2+deb12u6 | DEBIAN-CVE-2025-3360 |
| Debian:13 | glib2.0 | 2.84.1-1 | DEBIAN-CVE-2025-3360 |
| Debian:14 | glib2.0 | 2.84.1-1 | DEBIAN-CVE-2025-3360 |
| Ubuntu:22.04:LTS | glib2.0 | 2.72.4-0ubuntu2.7 | USN-7942-1 |
| Ubuntu:22.04:LTS | glib2.0 | 2.72.4-0ubuntu2.7 | UBUNTU-CVE-2025-3360 |
| Ubuntu:24.04:LTS | glib2.0 | 2.80.0-6ubuntu3.6 | USN-7942-1 |
| Ubuntu:24.04:LTS | glib2.0 | 2.80.0-6ubuntu3.6 | UBUNTU-CVE-2025-3360 |
| Ubuntu:25.10 | glib2.0 | 2.86.0-2ubuntu0.1 | USN-7942-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| glib | 0 – before 2.82.5 | |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://access.redhat.com/security/cve/CVE-2025-3360 vdb-entry, x_refsource_REDHAT
- RHBZ#2357754 issue-tracking, x_refsource_REDHAT
- https://gitlab.gnome.org/GNOME/glib/-/issues/3647
- https://gitlab.gnome.org/GNOME/glib/-/work_items/3647 exploit
- https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html