Skip to content
OpenAdvisories
Low ALAS2-2024-2487 1 CVE

Low: glib2 security update (Amazon Linux 2)

Published Feb 29, 2024 · Updated Mar 4, 2024

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-28153: An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

Fixed packages 7

ReleasePackageFixed in
Amazon Linux · 2 glib2 0:2.56.1-9.amzn2.0.7
Amazon Linux · 2 glib2-debuginfo 0:2.56.1-9.amzn2.0.7
Amazon Linux · 2 glib2-devel 0:2.56.1-9.amzn2.0.7
Amazon Linux · 2 glib2-doc 0:2.56.1-9.amzn2.0.7
Amazon Linux · 2 glib2-fam 0:2.56.1-9.amzn2.0.7
Amazon Linux · 2 glib2-static 0:2.56.1-9.amzn2.0.7
Amazon Linux · 2 glib2-tests 0:2.56.1-9.amzn2.0.7

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-28153.html