CVE-2021-28153Medium· 5.3▾ SunlitAn issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty fil…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.5 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.6%
An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
glib < 2.66.8brocade_fabric_operating_system_firmwaredebian_linux = 9.0fedora = 33Upgrade past the affected range:
glib 2.66.8Connected by shared product, vendor, weakness, or advisory.
CVE-2021-27219High· 7.5An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3
CVE-2021-27218High· 7.5An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4
CVE-2024-52533Critical· 9.8gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.
CVE-2023-32665Medium· 5.5A flaw was found in GLib
CVE-2023-32636Medium· 4.7A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499
CVE-2023-32643Medium· 5.3A flaw was found in GLib