diff --git a/debian/changelog b/debian/changelog
index 04be2efed63967a3ff7898f92fcabf0a2d6c2bbb..fb204dc195aaf3c16aa6d7e30fed2fe1e9a55718 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+glib2.0 (2.66.8-1+deb11u5+apertis0) apertis; urgency=medium
+
+  * Sync from debian/bullseye-security.
+
+ -- Apertis CI <devel@lists.apertis.org>  Mon, 25 Nov 2024 08:24:52 +0000
+
+glib2.0 (2.66.8-1+deb11u5) bullseye-security; urgency=medium
+
+  * Non-maintainer upload by the LTS Team.
+  * CVE-2024-52533: SOCKS4a proxy buffer overflow
+
+ -- Adrian Bunk <bunk@debian.org>  Mon, 18 Nov 2024 13:11:51 +0200
+
 glib2.0 (2.66.8-1+deb11u4+apertis0) apertis; urgency=medium
 
   * Sync from debian/bullseye.
diff --git a/debian/patches/0001-gsocks4aproxy-Fix-a-single-byte-buffer-overflow-in-c.patch b/debian/patches/0001-gsocks4aproxy-Fix-a-single-byte-buffer-overflow-in-c.patch
new file mode 100644
index 0000000000000000000000000000000000000000..f2641ee44b193afdb6a5a83dd038fa4e720d9495
--- /dev/null
+++ b/debian/patches/0001-gsocks4aproxy-Fix-a-single-byte-buffer-overflow-in-c.patch
@@ -0,0 +1,44 @@
+From ed0a8e858c5fef928b8eec4c473569c6007131b2 Mon Sep 17 00:00:00 2001
+From: Michael Catanzaro <mcatanzaro@redhat.com>
+Date: Thu, 19 Sep 2024 18:35:53 +0100
+Subject: gsocks4aproxy: Fix a single byte buffer overflow in connect messages
+
+`SOCKS4_CONN_MSG_LEN` failed to account for the length of the final nul
+byte in the connect message, which is an addition in SOCKSv4a vs
+SOCKSv4.
+
+This means that the buffer for building and transmitting the connect
+message could be overflowed if the username and hostname are both
+`SOCKS4_MAX_LEN` (255) bytes long.
+
+Proxy configurations are normally statically configured, so the username
+is very unlikely to be near its maximum length, and hence this overflow
+is unlikely to be triggered in practice.
+
+(Commit message by Philip Withnall, diagnosis and fix by Michael
+Catanzaro.)
+
+Fixes: #3461
+---
+ gio/gsocks4aproxy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/gio/gsocks4aproxy.c b/gio/gsocks4aproxy.c
+index 988ddaf56..c7c5d5ef6 100644
+--- a/gio/gsocks4aproxy.c
++++ b/gio/gsocks4aproxy.c
+@@ -77,9 +77,9 @@ g_socks4a_proxy_init (GSocks4aProxy *proxy)
+  * +----+----+----+----+----+----+----+----+----+----+....+----+------+....+------+
+  * | VN | CD | DSTPORT |      DSTIP        | USERID       |NULL| HOST |    | NULL |
+  * +----+----+----+----+----+----+----+----+----+----+....+----+------+....+------+
+- *    1    1      2              4           variable       1    variable
++ *    1    1      2              4           variable       1    variable    1
+  */
+-#define SOCKS4_CONN_MSG_LEN	    (9 + SOCKS4_MAX_LEN * 2)
++#define SOCKS4_CONN_MSG_LEN	    (10 + SOCKS4_MAX_LEN * 2)
+ static gint
+ set_connect_msg (guint8      *msg,
+ 		 const gchar *hostname,
+-- 
+2.30.2
+
diff --git a/debian/patches/series b/debian/patches/series
index dc63a95ec1ff07cb14a956c2d70e58e777130adb..4d1de2bae7d25caa2774bcbe33ecdccd00cdf91a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -73,3 +73,4 @@ CVE-2024-34397/tests-Add-a-test-for-signal-filtering-by-well-known-name.patch
 CVE-2024-34397/tests-Ensure-that-unsubscribing-with-GetNameOwner-in-flig.patch
 CVE-2024-34397/gdbusconnection-Allow-name-owners-to-have-the-syntax-of-a.patch
 gdbusmessage-Clean-the-cached-arg0-when-setting-the-messa.patch
+0001-gsocks4aproxy-Fix-a-single-byte-buffer-overflow-in-c.patch