CVE-2024-34397
MediumSummary
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1, where a GDBus-based client subscribing to signals from a trusted system service on a shared computer can receive spoofed D-Bus signals from other users of the same computer.
Risk Assessment
A local attacker can impersonate a trusted system service and send crafted D-Bus signals, potentially leading to privilege escalation or unauthorized data access.
Recommendation
Update GLib to version 2.78.5, 2.80.1, or later, which includes a fix that prevents spoofed D-Bus signals.
Original NVD description (English source)
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based cl