CVE-2021-28153

Name	CVE-2021-28153
Description	An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3044-1
Debian Bugs	984969

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glib2.0 (PTS)	bullseye	2.66.8-1+deb11u4	fixed
	bullseye (security)	2.66.8-1+deb11u3	fixed
	bookworm	2.74.6-2+deb12u4	fixed
	bookworm (security)	2.74.6-2+deb12u2	fixed
	trixie	2.82.2-2	fixed
	sid	2.82.2-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
glib2.0	source	stretch	2.50.3-2+deb9u3	DLA-3044-1
glib2.0	source	buster	2.58.3-2+deb10u3
glib2.0	source	(unstable)	2.66.7-2		984969

https://gitlab.gnome.org/GNOME/glib/-/issues/2325