Описание
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
| Релиз | Статус | Примечание |
|---|---|---|
| bionic | released | 2.56.4-0ubuntu0.18.04.4 |
| cosmic | released | 2.58.1-2ubuntu0.2 |
| devel | not-affected | 2.60.4-1 |
| disco | not-affected | 2.60.4-0ubuntu0.19.04.1 |
| esm-infra-legacy/trusty | not-affected | 2.40.2-0ubuntu1.1+esm3 |
| esm-infra/bionic | not-affected | 2.56.4-0ubuntu0.18.04.4 |
| esm-infra/xenial | not-affected | 2.48.2-0ubuntu4.4 |
| precise/esm | not-affected | 2.32.4-0ubuntu1.4 |
| trusty | ignored | end of standard support |
| trusty/esm | released | 2.40.2-0ubuntu1.1+esm3 |
Показывать по
Ссылки на источники
EPSS
5 Medium
CVSS2
7.5 High
CVSS3
Связанные уязвимости
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 ...
EPSS
5 Medium
CVSS2
7.5 High
CVSS3