Log in Start free

Vulnerability · Published Mar 11, 2021 · Assigned by mitre

CVE-2021-28153

Medium 5.3

In plain English

A medium-severity security flaw in the glib2-doc package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)2.7%top 14.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8glib2-doc2.56.4-156.el8ALSA-2021:4385
AlmaLinux:8glib2-static2.56.4-156.el8ALSA-2021:4385
AlmaLinux:9mingw32-glib22.70.1-2.el9ALSA-2022:8418
AlmaLinux:9mingw32-glib2-static2.70.1-2.el9ALSA-2022:8418
AlmaLinux:9mingw64-glib22.70.1-2.el9ALSA-2022:8418
AlmaLinux:9mingw64-glib2-static2.70.1-2.el9ALSA-2022:8418
Debian:12glib2.02.66.7-2DEBIAN-CVE-2021-28153
Debian:13glib2.02.66.7-2DEBIAN-CVE-2021-28153
Debian:14glib2.02.66.7-2DEBIAN-CVE-2021-28153
Rocky Linux:8glib20:2.56.4-156.el8RLSA-2021:4385

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References