CVE-2021-3800

Name	CVE-2021-3800
Description	A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DLA-3110-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
glib2.0 (PTS)	buster	2.58.3-2+deb10u3	vulnerable
	buster (security)	2.58.3-2+deb10u4	fixed
	bullseye	2.66.8-1	fixed
	bookworm, sid	2.74.6-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
glib2.0	source	buster	2.58.3-2+deb10u4		DLA-3110-1
glib2.0	source	(unstable)	2.64.0-1

Notes

https://gitlab.gnome.org/GNOME/glib/-/commit/3529bb4450a519959a5d9cb787404296322618a1 (2.63.6)
https://www.openwall.com/lists/oss-security/2017/06/23/8