The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir NULL NULL) and files using g_file_replace_contents (kfsb->file contents length NULL FALSE G_FILE_CREATE_REPLACE_DESTINATION NULL NULL NULL). Consequently it does not properly restrict directory (and file) permissions. Instead for directories 0777 permissions are used; for files default file permissions are used. This is similar to CVE-2019-12450.

🗓️ 18 Aug 2020 00:00:00Reported by MicrosoftType

GNOME GLib keyfile backend before 2.60.0 creates 0777 dirs and files with default permissions.

Reporter	Title	Published	Views	Family All 205
IBM Security Bulletins	Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities	15 Apr 202221:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2019-12450)	4 Aug 202117:37	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	2 Feb 202122:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2019-12450)	4 Aug 202117:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Verify Access	7 Jan 202200:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
Tenable Nessus	Amazon Linux 2 : glib2 (ALAS-2019-1289)	20 Sep 201900:00	–	nessus
Tenable Nessus	Amazon Linux 2 : glib2 (ALAS-2020-1553)	11 Nov 202000:00	–	nessus

Vulners

Node

18 Aug 2020 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 27.5

CVSS 3.17.5 - 9.8

CVSS 37.5

EPSS0.01578