Privilege escalation in GNOME Glib library



Published: 2019-06-03
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2019-12450
CWE-ID CWE-264
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe
Gnome GLib
Universal components / Libraries / Libraries used by multiple products

Vendor Gnome Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18658

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-12450

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the application applies default directory permissions to files while copying them in file_copy_fallback() function in gio/gfile.c. A local user can interfere with the copying operation and gain access to otherwise restricted files, as the application applies correct access permissions after the file was copied only.

Such application behavior allows a local user to access potentially sensitive data or modify file contents in case directory permissions that were applied to the file allow such operations.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gnome GLib: 2.15.0 - 2.61.1


CPE2.3 External links

http://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###