CVE-2021-28153

NameCVE-2021-28153
DescriptionAn issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3044-1
Debian Bugs984969

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
glib2.0 (PTS)buster2.58.3-2+deb10u3fixed
buster (security)2.58.3-2+deb10u4fixed
bullseye2.66.8-1fixed
bookworm, sid2.74.2-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
glib2.0sourcestretch2.50.3-2+deb9u3DLA-3044-1
glib2.0sourcebuster2.58.3-2+deb10u3
glib2.0source(unstable)2.66.7-2984969

Notes

https://gitlab.gnome.org/GNOME/glib/-/issues/2325

Search for package or bug name: Reporting problems