Fluid Attacks Database

Description

A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	glib2.0	>=0 <2.64.0-1	2.64.0-1
debian 12	glib2.0	>=0 <2.64.0-1	2.64.0-1
debian 13	glib2.0	>=0 <2.64.0-1	2.64.0-1
debian 14	glib2.0	>=0 <2.64.0-1	2.64.0-1
rpm rhel6	glib2	-	-
rpm rhel6	firefox	-	-
rpm rhel7	firefox	-	-
rpm rhel8	glib2	<0:2.56.4-156.el8	0:2.56.4-156.el8
rpm rhel7	glib2	-	-

Aliases

1. CVE-2021-38002. NVD-2021-38003. OSV-DEBIAN-2021-38004. OSV-2021-38005. SECURITY-TRACKER-CVE-2021-3800

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.