Read the docs
TI-2024-35203 Aliases CVE-2024-52533GHSA-5rq6-q8gw-qqpr

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant…

Priority MEDIUM 52CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 26 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-120 and the CVSS impact.

Summary

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01507 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 13 advisoriesRed Hat: 26 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:*before 2.82.1VulnerableGNOME
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*10VulnerableNetApp
  • cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:* Versions before 2.82.1 Vulnerable ·GNOME
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:* Versions 10 Vulnerable ·NetApp

Remediation

Red Hat 13 advisories

  • RHSA-2025:14988 Released 2025-09-02 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) glib2-2.56.4-158.el8_6.2, glib2-devel-2.56.4-158.el8_6.2, glib2-fam-2.56.4-158.el8_6.2 +1
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) glib2-2.56.4-158.el8_6.2, glib2-devel-2.56.4-158.el8_6.2, glib2-fam-2.56.4-158.el8_6.2 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) glib2-2.56.4-158.el8_6.2, glib2-devel-2.56.4-158.el8_6.2, glib2-fam-2.56.4-158.el8_6.2 +1
  • RHSA-2025:14989 Released 2025-09-02 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) glib2-2.56.4-162.el8_8, glib2-devel-2.56.4-162.el8_8, glib2-fam-2.56.4-162.el8_8 +1
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) glib2-2.56.4-162.el8_8, glib2-devel-2.56.4-162.el8_8, glib2-fam-2.56.4-162.el8_8 +1
  • RHSA-2025:14991 Released 2025-09-02 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) glib2-2.56.4-8.el8_2.2, glib2-devel-2.56.4-8.el8_2.2, glib2-fam-2.56.4-8.el8_2.2 +1
Show 10 more Red Hat advisories
  • RHSA-2025:14990 Released 2025-09-02 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) glib2-2.56.4-10.el8_4.2, glib2-devel-2.56.4-10.el8_4.2, glib2-fam-2.56.4-10.el8_4.2 +1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) glib2-2.56.4-10.el8_4.2, glib2-devel-2.56.4-10.el8_4.2, glib2-fam-2.56.4-10.el8_4.2 +1
  • RHSA-2025:13335 Released 2025-08-07 · Red Hat rating Important
    Insights proxy Container Image
    • Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
  • RHSA-2025:12275 Released 2025-07-30 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) glib2-devel-2.68.4-5.el9_0.2, glib2-doc-2.68.4-5.el9_0.2, glib2-tests-2.68.4-5.el9_0.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) glib2-2.68.4-5.el9_0.2
  • RHSA-2025:11662 Released 2025-07-23 · Red Hat rating Moderate
    Red Hat OpenShift distributed tracing platform (Jaeger) 3.5.1 release
    • Red Hat OpenShift distributed tracing 3.6.0 registry.redhat.io/rhosdt/jaeger-agent-rhel8, registry.redhat.io/rhosdt/jaeger-all-in-one-rhel8, registry.redhat.io/rhosdt/jaeger-collector-rhel8 +6
  • RHSA-2025:11374 Released 2025-07-17 · Red Hat rating Moderate
    glib2 security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) glib2-static-2.68.4-14.el9_4.3
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) glib2-devel-2.68.4-14.el9_4.3, glib2-doc-2.68.4-14.el9_4.3, glib2-tests-2.68.4-14.el9_4.3
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) glib2-2.68.4-14.el9_4.3
  • RHSA-2025:11373 Released 2025-07-17 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) glib2-devel-2.68.4-7.el9_2.2, glib2-doc-2.68.4-7.el9_2.2, glib2-tests-2.68.4-7.el9_2.2
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) glib2-2.68.4-7.el9_2.2
  • RHSA-2025:11327 Released 2025-07-16 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) glib2-2.56.4-166.el8_10, glib2-devel-2.56.4-166.el8_10, glib2-fam-2.56.4-166.el8_10 +1
    • Red Hat Enterprise Linux CRB (v. 8) glib2-doc-2.56.4-166.el8_10, glib2-static-2.56.4-166.el8_10
  • RHSA-2025:11140 Released 2025-07-15 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux AppStream (v. 9) glib2-devel-2.68.4-16.el9_6.2, glib2-doc-2.68.4-16.el9_6.2, glib2-tests-2.68.4-16.el9_6.2
    • Red Hat Enterprise Linux BaseOS (v. 9) glib2-2.68.4-16.el9_6.2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) glib2-static-2.68.4-16.el9_6.2
  • RHSA-2025:10855 Released 2025-07-14 · Red Hat rating Moderate
    glib2 security update
    • Red Hat Enterprise Linux AppStream (v. 10) glib2-devel-2.80.4-4.el10_0.6, glib2-tests-2.80.4-4.el10_0.6
    • Red Hat Enterprise Linux BaseOS (v. 10) glib2-2.80.4-4.el10_0.6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) glib2-doc-2.80.4-4.el10_0.6, glib2-static-2.80.4-4.el10_0.6
  • RHSA-2025:0936 Released 2025-02-04 · Red Hat rating Moderate
    mingw-glib2 security update
    • Red Hat CodeReady Linux Builder (v. 9) mingw-glib2-2.78.6-2.el9, mingw32-glib2-2.78.6-2.el9, mingw32-glib2-static-2.78.6-2.el9 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2025:0936
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:11374
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:10855
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:11140
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:12275
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:11373
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:11374
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2025:10855
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2025:11327
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2025:11140
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2025:14991
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2025:14990
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2025:14988
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2025:14988
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2025:14989
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2025:12275
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2025:11373
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2025:11374
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2025:14990
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2025:14988
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2025:14989
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2025:11327
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2025:10855
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:11140
Red Hat Insights proxy 1.5Fixed RHSA-2025:13335
Red Hat OpenShift distributed tracing 3.6.0Fixed RHSA-2025:11662
Not affected: 1 product
  • Red Hat Enterprise Linux 10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-52533
  2. 2026-10-03 Alias added: GHSA-5rq6-q8gw-qqpr

References

Exploit 1

Advisory 3

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences