Description
The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glib2.0 | 2.22.0-1 | — |
| Debian 13 | glib2.0 | 2.22.0-1 | — |
| Debian 12 | glib2.0 | 2.22.0-1 | — |
References
- https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135
- 39656 third-party-advisory
- SUSE-SR:2010:010 vendor-advisory
- https://bugzilla.gnome.org/show_bug.cgi?id=593406
- [oss-security] 20090908 CVE Request - glib symlink copying permission exposure mailing-list
- ADV-2010-1001 vdb-entry