An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
Se detectó un problema en GNOME GLib versiones anteriores a 2.66.8. Cuando es usada la función g_file_replace() con G_FILE_CREATE_REPLACE_DESTINATION para reemplazar una ruta que es un enlace simbólico colgante, también crea incorrectamente el destino del enlace simbólico como un archivo vacío, lo que posiblemente podría tener relevancia de seguridad si el enlace simbólico está controlado por un atacante. (Si la ruta es un enlace simbólico para un archivo que ya existe, entonces el contenido de ese archivo permanece sin cambios correctamente)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | LOW |
| Availability Impact | NONE |
AV:N/AC:L/Au:N/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-59
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnome | glib | * | <built-in method update of dict object at 0x7fd34088eb80> | Application |
| broadcom | brocade_fabric_operating_system_firmware | - | <built-in method update of dict object at 0x7fd34088c740> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd341efb640> | Operating System |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd34b8db2c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:broadcom:brocade_fabric_operating_system_firmware:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |