update: glib

[dongsupark]

Name: glib
CVEs: CVE-2025-14512, CVE-2026-0988
CVSSs: 6.5, 3.7
Action Needed: update to >= 2.87.1

Summary:

• CVE-2025-14512: A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.
  • https://bugzilla.redhat.com/show_bug.cgi?id=2421339
• CVE-2026-0988: A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).
  • https://gitlab.gnome.org/GNOME/glib/-/issues/3851

refmap.gentoo: TBD