Fluid Attacks Database

Description

The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	glib2.0	>=0 <2.22.0-1	2.22.0-1
debian 12	glib2.0	>=0 <2.22.0-1	2.22.0-1
debian 13	glib2.0	>=0 <2.22.0-1	2.22.0-1
debian 14	glib2.0	>=0 <2.22.0-1	2.22.0-1

Aliases

1. CVE-2009-32892. NVD-2009-32893. OSV-DEBIAN-2009-32894. OSV-2009-32895. SECURITY-TRACKER-CVE-2009-3289

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.