An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
References
Configurations
History
21 Nov 2024, 05:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gitlab.gnome.org/GNOME/glib/-/issues/2325 - Exploit, Issue Tracking, Patch, Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RXTD5HCP2K4AAUSWWZTBKQNHRCTAEOF/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICUTQPHZNZWX2DZR46QFLQZRHVMHIILJ/ - | |
| References | () https://security.gentoo.org/glsa/202107-13 - Third Party Advisory | |
| References | () https://security.netapp.com/advisory/ntap-20210416-0003/ - Third Party Advisory |
07 Nov 2023, 03:32
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
Information
Published : 2021-03-11 22:15
Updated : 2024-11-21 05:59
NVD link : CVE-2021-28153
Mitre link : CVE-2021-28153
CVE.ORG link : CVE-2021-28153
JSON object : View
Products Affected
debian
- debian_linux
fedoraproject
- fedora
gnome
- glib
broadcom
- brocade_fabric_operating_system_firmware
CWE
CWE-59
Improper Link Resolution Before File Access ('Link Following')