Medium4.8Red Hat Linux

Medium [CVE-2025-4373] buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar

This medium-severity Red Hat Linux advisory covers CVE-2025-4373 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support.

CVE-2025-4373 Published May 6, 2025Updated by vendor May 6, 2025

CVE-2025-4373

Affected products & platforms

Red Hat LinuxRed Hat Enterprise Linux

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.

Red Hat severity: Moderate — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-124.

Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Insights proxy 1.5; Red Hat OpenShift distributed tracing 3.6.1; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Fixed versions

glib2-0:2.80.4-4.el10_0.6
glib2-0:2.56.4-166.el8_10
glib2-0:2.56.4-8.el8_2.2
glib2-0:2.56.4-10.el8_4.2
glib2-0:2.56.4-158.el8_6.2
glib2-0:2.56.4-162.el8_8
glib2-0:2.68.4-16.el9_6.2
glib2-0:2.68.4-5.el9_0.2
glib2-0:2.68.4-7.el9_2.2
glib2-0:2.68.4-14.el9_4.3
insights-proxy/insights-proxy-container-rhel9:1.5.5-1754504343
rhosdt/jaeger-agent-rhel8:rhosdt-3.6-1753265330
rhosdt/jaeger-all-in-one-rhel8:rhosdt-3.6-1753265394
rhosdt/jaeger-collector-rhel8:rhosdt-3.6-1753265332
rhosdt/jaeger-es-index-cleaner-rhel8:rhosdt-3.6-1753265435
rhosdt/jaeger-es-rollover-rhel8:rhosdt-3.6-1753265342
rhosdt/jaeger-ingester-rhel8:rhosdt-3.6-1753265332
rhosdt/jaeger-operator-bundle:rhosdt-3.6-1753269432
rhosdt/jaeger-query-rhel8:rhosdt-3.6-1753265411
rhosdt/jaeger-rhel8-operator:rhosdt-3.6-1753265314
RHSA-2025:10855
RHSA-2025:11327
RHSA-2025:14991
RHSA-2025:14990
RHSA-2025:14988
RHSA-2025:14989
RHSA-2025:11140
RHSA-2025:12275
RHSA-2025:11373
RHSA-2025:11374
RHSA-2025:13335
RHSA-2025:11662

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Currently, no mitigation is available for this vulnerability.

Official advisory · high-confidence parse· fetched 4 days ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Red Hat Security Data APIofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://access.redhat.com/hydra/rest/securitydata/cve.json; this link opens the Red Hat Linux advisory index instead of the raw feed document.
Red Hat Linux
Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
Red Hat Linux
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2025-4373NVD CVE.org MITRE

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.