[Debian] High CVE: CVE-2023-29499/CVE-2023-32611/CVE-2023-32665 glib2.0 : multiple CVEs

[Yue Tao]

CVE-2023-29499: https://nvd.nist.gov/vuln/detail/CVE-2023-29499

A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

CVE-2023-32611: https://nvd.nist.gov/vuln/detail/CVE-2023-32611

A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.

CVE-2023-32665: https://nvd.nist.gov/vuln/detail/CVE-2023-32665

A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

Base Score: High

Reference:

['libglib2.0-0_2.66.8-1_amd64.deb===>libglib2.0-0_2.66.8-1+deb11u1_amd64.deb']

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/910295

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/910295
Committed: https://opendev.org/starlingx/tools/commit/874990dca80b9a79559f6257ef90685cd6e552b1
Submitter: "Zuul (22348)"
Branch: master

commit 874990dca80b9a79559f6257ef90685cd6e552b1
Author: Wentao Zhang <email address hidden>
Date: Tue Feb 27 11:16:15 2024 +0800

    Debian: glib2.0 : fix CVE-2023-29499/CVE-2023-32611/CVE-2023-32665

    Upgrade libglib2.0-0 to 2.66.8-1+deb11u1
    Upgrade libglib2.0-dev to 2.66.8-1+deb11u1
    Upgrade libglib2.0-bin to 2.66.8-1+deb11u1
    Upgrade libglib2.0-dev-bin to 2.66.8-1+deb11u1

    Refer to:
    https://nvd.nist.gov/vuln/detail/CVE-2023-29499
    https://nvd.nist.gov/vuln/detail/CVE-2023-32611
    https://nvd.nist.gov/vuln/detail/CVE-2023-32665

    Test Plan:
    Pass: downloader
    Pass: build-pkgs --clean --all
    Pass: build-image
    Pass: boot

    Closes-bug: #2052924

    Change-Id: I2531757a643b3b443de392e30983378341d5b581
    Signed-off-by: Wentao Zhang <email address hidden>