CVE-2021-28153

NameCVE-2021-28153
DescriptionAn issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3044-1
Debian Bugs984969

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
glib2.0 (PTS)bullseye2.66.8-1+deb11u4fixed
bullseye (security)2.66.8-1+deb11u3fixed
bookworm2.74.6-2+deb12u3fixed
bookworm (security)2.74.6-2+deb12u2fixed
sid, trixie2.82.2-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
glib2.0sourcestretch2.50.3-2+deb9u3DLA-3044-1
glib2.0sourcebuster2.58.3-2+deb10u3
glib2.0source(unstable)2.66.7-2984969

Notes

https://gitlab.gnome.org/GNOME/glib/-/issues/2325

Search for package or bug name: Reporting problems