Incorrect default permissions in Gnome GLib - CVE-2019-13012

Vulnerability identifier: #VU18944

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-13012

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

Gnome GLib
Amazon Linux AMI
Anolis OS
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Opensuse
accountsservice (Red Hat package)
vala (Red Hat package)
gvfs (Red Hat package)
gjs (Red Hat package)
webkit2gtk3 (Red Hat package)
glib2 (Red Hat package)
nautilus (Red Hat package)
gnome-online-accounts (Red Hat package)
gnome-control-center (Red Hat package)
gnome-terminal (Red Hat package)
gdm (Red Hat package)
gnome-boxes (Red Hat package)
gnome-software (Red Hat package)
gnome-settings-daemon (Red Hat package)
gnome-shell-extensions (Red Hat package)
gnome-shell (Red Hat package)
mutter (Red Hat package)
chrome-gnome-shell (Red Hat package)
libepubgen (Red Hat package)
gamin (Red Hat package)
libvisual (Red Hat package)
dleyna-core (Red Hat package)
dleyna-server (Red Hat package)
woff2 (Red Hat package)
cairomm (Red Hat package)
gtk-doc (Red Hat package)
soundtouch (Red Hat package)
OpenEXR (Red Hat package)
enchant2 (Red Hat package)
geoclue2 (Red Hat package)
20 (Red Hat package)
atkmm (Red Hat package)
gtkmm24 (Red Hat package)
gtk2 (Red Hat package)
glib2
pangomm (Red Hat package)
glibmm24 (Red Hat package)
glib2-devel
glib2-fam
glib2-tests
libsass (Red Hat package)
gtkmm30 (Red Hat package)
geocode-glib (Red Hat package)
gnome-photos (Red Hat package)
libdazzle (Red Hat package)
Cloud Pak for Security (CP4S)
IBM Security Verify Access
Web Terminal
OpenShift Virtualization
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)

Install updates from vendor's website.

Gnome GLib - update to 2.59.1
accountsservice (Red Hat package) - update to 0.6.55-1.el8
vala (Red Hat package) - update to 0.40.19-2.el8
Cloud Pak for Security (CP4S) - update to 1.8.0.0
gvfs (Red Hat package) - update to 1.36.2-11.el8
gjs (Red Hat package) - update to 1.56.2-5.el8
webkit2gtk3 (Red Hat package) - update to 2.30.4-1.el8
glib2 (Red Hat package) - update to 2.56.4-9.el8
nautilus (Red Hat package) - update to 3.28.1-15.el8
gnome-online-accounts (Red Hat package) - update to 3.28.2-2.el8
gnome-control-center (Red Hat package) - update to 3.28.2-27.el8
gnome-terminal (Red Hat package) - update to 3.28.3-3.el8
gdm (Red Hat package) - update to 3.28.3-39.el8
gnome-boxes (Red Hat package) - update to 3.36.5-8.el8
gnome-software (Red Hat package) - update to 3.36.1-5.el8
gnome-settings-daemon (Red Hat package) - update to 3.32.0-14.el8
gnome-shell-extensions (Red Hat package) - update to 3.32.1-14.el8
gnome-shell (Red Hat package) - update to 3.32.2-30.el8
mutter (Red Hat package) - update to 3.32.2-57.el8
chrome-gnome-shell (Red Hat package) - update to 10.1-7.el8
libepubgen (Red Hat package) - update to 0.1.0-3.el8
gamin (Red Hat package) - update to 0.1.10-32.el8
libvisual (Red Hat package) - update to 0.4.0-25.el8
dleyna-core (Red Hat package) - update to 0.6.0-3.el8
dleyna-server (Red Hat package) - update to 0.6.0-3.el8
woff2 (Red Hat package) - update to 1.0.2-5.el8
Web Terminal - update to 1.3
cairomm (Red Hat package) - update to 1.12.0-8.el8
gtk-doc (Red Hat package) - update to 1.28-3.el8
soundtouch (Red Hat package) - update to 2.0.0-3.el8
OpenEXR (Red Hat package) - update to 2.2.0-12.el8
enchant2 (Red Hat package) - update to 2.2.3-3.el8
geoclue2 (Red Hat package) - update to 2.5.5-2.el8
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
20 (Red Hat package) - update to 2.10.0-6.el8
atkmm (Red Hat package) - update to 2.24.2-7.el8
gtkmm24 (Red Hat package) - update to 2.24.5-6.el8
gtk2 (Red Hat package) - update to 2.24.32-5.el8
glib2 - update to 2.36.3-5.23
pangomm (Red Hat package) - update to 2.40.1-6.el8
glibmm24 (Red Hat package) - update to 2.56.0-2.el8
glib2 - update to 2.56.4-10
glib2-devel - update to 2.56.4-10
glib2-fam - update to 2.56.4-10
glib2-tests - update to 2.56.4-10
libsass (Red Hat package) - update to 3.4.5-6.el8
gtkmm30 (Red Hat package) - update to 3.22.2-3.el8
geocode-glib (Red Hat package) - update to 3.26.0-3.el8
gnome-photos (Red Hat package) - update to 3.28.1-4.el8
libdazzle (Red Hat package) - update to 3.28.5-2.el8
Dell EMC Unity XT Operating Environment (OE) - update to 5.0.2.0.5.009
Dell EMC Unity Operating Environment (OE) - update to 5.0.2.0.5.009
Dell EMC Unity VSA Operating Environment (OE) - update to 5.0.2.0.5.009

• https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429
• https://gitlab.gnome.org/GNOME/glib/issues/1658
• https://gitlab.gnome.org/GNOME/glib/merge_requests/450

• Insecure permissions for files and folders in Gnome Glib
• OpenSUSE Linux update for glib2
• Red Hat update for .NET Core on Red Hat Enterprise Linux
• Red Hat Enterprise Linux 8 update for GNOME
• Multiple vulnerabilities in Red Hat Web Terminal
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in Dell EMC Unity Family, Dell EMC Unity XT Family
• Amazon Linux AMI update for glib2
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Anolis OS update for glib2 (Anolis OS 8.4)