{"id":"CVE-2025-60019","state":"PUBLISHED","title":"Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()","description":"glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location.","publishedAt":"2025-09-25T15:53:02.569Z","updatedAt":"2026-06-30T07:57:02.631Z","severity":{"score":3.7,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","source":"redhat"},"assigner":"redhat","products":["glib-networking","Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat Enterprise Linux 9"],"affected":[{"packageName":"glib-networking","defaultStatus":"unaffected","versions":[{"version":"2.60","status":"affected","lessThan":"2.80.2","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/glib-networking"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":["https://access.redhat.com/security/cve/CVE-2025-60019","https://bugzilla.redhat.com/show_bug.cgi?id=2398140","https://gitlab.gnome.org/GNOME/glib-networking/-/issues/227"],"weaknesses":["CWE-476"],"ingestedAt":"2026-10-29T20:09:48.677Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/60xxx/CVE-2025-60019.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-60019","state":"PUBLISHED","datePublished":"2025-09-25T15:53:02.569Z","dateUpdated":"2026-06-30T07:57:02.631Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-09-24T12:21:36.721Z"},"containers":{"cna":{"title":"Glib-networking: uninitialized memory dereferences on glib-networking through glib-networking/tls/openssl/gtlsbio.c via g_tls_bio_new_from_iostream() and g_tls_bio_new_from_datagram_based()","descriptions":[{"lang":"en","value":"glib-networking's OpenSSL backend fails to properly check the return value of memory allocation routines. An out of memory condition could potentially result in writing to an invalid memory location."}],"affected":[{"packageName":"glib-networking","defaultStatus":"unaffected","versions":[{"version":"2.60","status":"affected","lessThan":"2.80.2","versionType":"semver"}],"collectionURL":"https://gitlab.gnome.org/GNOME/glib-networking"},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"glib-networking","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-60019","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2398140","name":"RHBZ#2398140","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.gnome.org/GNOME/glib-networking/-/issues/227"}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","description":"NULL Pointer Dereference","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-30T07:57:02.631Z"},"datePublic":"2025-09-15T00:00:00.000Z","x_redhatCweChain":"CWE-476: NULL Pointer Dereference","timeline":[{"lang":"en","time":"2025-09-25T12:54:56.110Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-09-15T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-25T16:30:38.189227Z","id":"CVE-2025-60019","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-25T16:33:34.069Z"}}]}}}