rpm: races with chown/chmod/capabilities calls during installation

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system...

Insecure File Permissions

glib2 uses improper file permissions during a copy operation. Default permissions are configured on files during a copy operation. This causes a race condition whereby an attacker will be able to access and modify affected files during the copy operation...