glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress

filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used...

CVE-2019-12450 affecting package glib 2.58.0-10

CVE-2019-12450 affecting package glib 2.58.0-10. A patched version of the package is available...

CVE-2019-13012 affecting package glib 2.58.0-10

CVE-2019-13012 affecting package glib 2.58.0-10. A patched version of the package is available...

EulerOS Virtualization for ARM 64 3.0.2.0 : glib-networking (EulerOS-SA-2020-1975)

According to the version of the glib-networking package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification o...

Huawei EulerOS: Security Advisory for glib-networking (EulerOS-SA-2020-1975)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2020-6933 · Gnome +2 · Gnome Glib +2

Name of the Vulnerable Software and Affected Versions: GNOME GLib versions prior to 2.65.3 Description: The issue is related to an integer overflow in the g option group add entries function of the Glib library. This could potentially lead to an out-of-bounds write. The exploitation of this issue...

In GNOME glib-networking through 2.64.2 the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior to fail the certificate verification. Applications that fail to provide the server identity including Balsa before 2.5.11 and 2.6.x before 2.6.1 accept a TLS certificate if the certificate is valid for any host.

...

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir NULL NULL) and files using g_file_replace_contents (kfsb->file contents length NULL FALSE G_FILE_CREATE_REPLACE_DESTINATION NULL NULL NULL). Consequently it does not properly restrict directory (and file) permissions. Instead for directories 0777 permissions are used; for files default file permissions are used. This is similar to CVE-2019-12450.

...

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead default permissions are used.

...

MGASA-2020-0314 Updated glib-networking packages fix security vulnerability

The updated packages fix a security vulnerability: In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended...

Updated glib-networking packages fix security vulnerability

The updated packages fix a security vulnerability: In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended...

Information Disclosure

glib is vulnerable to information disclosure. The vulnerability exists as GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxyaddr field is mishandled. This bug is...

GLib Networking: Improper certificate validation

Background Network-related giomodules for glib Description GTlsClientConnection skips hostname verification of the server’s TLS certificate if the application fails to specify the expected server identity. Impact There may be a breach of integrity or confidentiality in connections made using GLib...

GLSA-202007-50 : GLib Networking: Improper certificate validation

The remote host is affected by the vulnerability described in GLSA-202007-50 GLib Networking: Improper certificate validation GTlsClientConnection skips hostname verification of the servers TLS certificate if the application fails to specify the expected server identity. Impact : There may be a...

glib:fuzz_uri_escape: Heap-buffer-overflow in uri_decoder

Project: https://gitlab.gnome.org/GNOME/glib.git Detailed Report: https://oss-fuzz.com/testcase?key=4881440516079616 Project: glib Fuzzing Engine: libFuzzer Fuzz Target: fuzzuriescape Job Type: libfuzzerasanglib Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

glib:fuzz_uri_parse: Heap-buffer-overflow in g_string_insert_len

Project: https://gitlab.gnome.org/GNOME/glib.git Detailed Report: https://oss-fuzz.com/testcase?key=4902921962782720 Project: glib Fuzzing Engine: afl Fuzz Target: fuzzuriparse Job Type: aflasanglib Platform Id: linux Crash Type: Heap-buffer-overflow READ 5 Crash Address: 0x602000000134 Crash...

glib:fuzz_uri_parse_params: Heap-buffer-overflow in uri_decoder

Project: https://gitlab.gnome.org/GNOME/glib.git Detailed Report: https://oss-fuzz.com/testcase?key=4815738421641216 Project: glib Fuzzing Engine: afl Fuzz Target: fuzzuriparseparams Job Type: aflasanglib Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6020000000d2 Cra...

USN-4405-1: GLib Networking vulnerability

It was discovered that glib-networking skipped hostname certificate verification if the application failed to specify the server identity. A remote attacker could use this to perform a person-in-the-middle attack and expose sensitive information...

USN-4405-1 glib-networking vulnerability

It was discovered that glib-networking skipped hostname certificate verification if the application failed to specify the server identity. A remote attacker could use this to perform a person-in-the-middle attack and expose sensitive information...

Ubuntu: Security Advisory (USN-4405-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...