CVE-2019-12450
published 2019-05-29CVE-2019-12450: file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress…
PriorityP344critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.62%
85.4th percentile
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | glib2.0 | < glib2.0 2.60.5-1 (bookworm) | glib2.0 2.60.5-1 (bookworm) |
| debian | glib2.0 | < glib2.0 2.58.3-2 (bookworm) | glib2.0 2.58.3-2 (bookworm) |
| fedoraproject | fedora | — | — |
| gnome | glib | >= 2.0.0 < 2.59.1 | 2.59.1 |
| gnome | glib | 2.15.0 – 2.61.1 | — |
| msrc | cbl2_glib_2.60.1-5_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_glib_2.58.0-6_on_cbl_mariner_1.0 | — | — |
| opensuse | leap | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
glib2: insecure permissions for files and directories
vendor_redhat·2019-06-28·CVSS 9.8
CVE-2019-13012 [CRITICAL] CWE-732 glib2: insecure permissions for files and directories
glib2: insecure permissions for files and directories
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
Statement: This issue affects glib2 as shipped with Red Hat Enterprise Linux 6, 7 and 8 and was rated as having a Low security impact by Red Hat Product Security team.
Although Red Hat Enterprise Linux versions above ships the vulnerable
Microsoft
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir NULL NULL) and files using g_file_replace_contents (kfsb-
vendor_msrc·2019-06-11·CVSS 7.5
CVE-2019-13012 [CRITICAL] CWE-732 The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir NULL NULL) and files using g_file_replace_contents (kfsb-
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir NULL NULL) and files using g_file_replace_contents (kfsb->file contents length NULL FALSE G_FILE_CREATE_REPLACE_DESTINATION NULL NULL NULL). Consequently it does not properly restrict directory (and file) permissions. Instead for directories 0777 permissions are used; for files default file permissions are used. This is similar to CVE-2019-12450.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure
Ubuntu
GLib vulnerability
vendor_ubuntu·2019-06-11
CVE-2019-12450 GLib vulnerability
Title: GLib vulnerability
Summary: GLib could be made to expose sensitive information if it
received a specially crafted file.
USN-4014-1 fixed a vulnerability in GLib. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that GLib incorrectly handled certain files.
An attacker could possibly use this issue to access sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
GLib vulnerability
vendor_ubuntu·2019-06-10
CVE-2019-12450 GLib vulnerability
Title: GLib vulnerability
Summary: GLib could be made to expose sensitive information if it
received a specially crafted file.
It was discovered that GLib incorrectly handled certain files.
An attacker could possibly use this issue to access sensitive information.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress
vendor_redhat·2019-05-23·CVSS 9.8
CVE-2019-12450 [CRITICAL] CWE-552 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress
glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
Statement: This issue affects the versions of glib2 as shipped with Red Hat Enterprise Linux 6, 7 and 8 . Red Hat Product Security has rated this issue as having a security impact of Moderate.
Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Important, and is not currently planned to be addressed in future updates. For additional information, refer to the R
Microsoft
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead default permissions are used.
vendor_msrc·2019-05-14·CVSS 9.8
CVE-2019-12450 [CRITICAL] CWE-362 file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead default permissions are used.
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead default permissions are used.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to re
Debian
CVE-2019-13012: glib2.0 - The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates d...
vendor_debian·2019·CVSS 9.8
CVE-2019-13012 [CRITICAL] CVE-2019-13012: glib2.0 - The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates d...
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
Scope: local
bookworm: resolved (fixed in 2.60.5-1)
bullseye: resolved (fixed in 2.60.5-1)
forky: resolved (fixed in 2.60.5-1)
sid: resolved (fixed in 2.60.5-1)
trixie: resolved (fixed in 2.60.5-1)
Debian
CVE-2019-12450: glib2.0 - file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not p...
vendor_debian·2019·CVSS 9.8
CVE-2019-12450 [CRITICAL] CVE-2019-12450: glib2.0 - file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not p...
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
Scope: local
bookworm: resolved (fixed in 2.58.3-2)
bullseye: resolved (fixed in 2.58.3-2)
forky: resolved (fixed in 2.58.3-2)
sid: resolved (fixed in 2.58.3-2)
trixie: resolved (fixed in 2.58.3-2)
GHSA
GHSA-4cmr-h54h-4w78: The keyfile settings backend in GNOME GLib (aka glib2
ghsa_unreviewed·2022-05-24·CVSS 9.8
CVE-2019-13012 [CRITICAL] CWE-732 GHSA-4cmr-h54h-4w78: The keyfile settings backend in GNOME GLib (aka glib2
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.59.1 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
GHSA
GHSA-m54p-gqx6-f2r7: file_copy_fallback in gio/gfile
ghsa_unreviewed·2022-05-24
CVE-2019-12450 [CRITICAL] CWE-362 GHSA-m54p-gqx6-f2r7: file_copy_fallback in gio/gfile
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
OSV
CVE-2019-13012: The keyfile settings backend in GNOME GLib (aka glib2
osv·2019-06-28·CVSS 9.8
CVE-2019-13012 [CRITICAL] CVE-2019-13012: The keyfile settings backend in GNOME GLib (aka glib2
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
OSV
CVE-2019-12450: file_copy_fallback in gio/gfile
osv·2019-05-29·CVSS 9.8
CVE-2019-12450 [CRITICAL] CVE-2019-12450: file_copy_fallback in gio/gfile
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-13012 glib2: insecure permissions for files and directories
bugzilla·2019-07-10·CVSS 9.8
CVE-2019-13012 [CRITICAL] CVE-2019-13012 glib2: insecure permissions for files and directories
CVE-2019-13012 glib2: insecure permissions for files and directories
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.59.1 creates
directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and
files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE,
G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not
properly restrict directory (and file) permissions. Instead, for directories,
0777 permissions are used; for files, default file permissions are used. This is
similar to CVE-2019-12450.
Reference:
https://gitlab.gnome.org/GNOME/glib/issues/1658
Upstream commit:
https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429
Discussion:
Created glib2 tracking bugs for this issue:
Aff
Bugzilla
CVE-2019-12450 mingw-glib2: glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [epel-7]
bugzilla·2019-06-11·CVSS 9.8
CVE-2019-12450 [CRITICAL] CVE-2019-12450 mingw-glib2: glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [epel-7]
CVE-2019-12450 mingw-glib2: glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM ch
Bugzilla
CVE-2019-12450 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress
bugzilla·2019-06-11·CVSS 9.8
CVE-2019-12450 [CRITICAL] CVE-2019-12450 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress
CVE-2019-12450 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 creates new files with default permissions and set the correct permissions after the operation is finished. This might cause that the files can be accessible by more users during the operation than expected.
Upstream Commit:
https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174
Discussion:
Created glib2 tracking bugs for this issue:
Affects: fedora-all [bug 1719142]
---
Created mingw-glib2 tracking bugs for this issue:
Affects: fedora-all [bug 1719268]
---
Created mingw-glib2 tracking bugs for this issue:
Affects: epel-7 [bug 1719
Bugzilla
CVE-2019-12450 mingw-glib2: glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [fedora-all]
bugzilla·2019-06-11·CVSS 9.8
CVE-2019-12450 [CRITICAL] CVE-2019-12450 mingw-glib2: glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [fedora-all]
CVE-2019-12450 mingw-glib2: glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in th
Bugzilla
CVE-2019-12450 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [fedora-all]
bugzilla·2019-06-11·CVSS 9.8
CVE-2019-12450 [CRITICAL] CVE-2019-12450 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [fedora-all]
CVE-2019-12450 glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changel
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.htmlhttps://access.redhat.com/errata/RHSA-2019:3530https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174https://lists.debian.org/debian-lts-announce/2019/06/msg00013.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/https://security.netapp.com/advisory/ntap-20190606-0003/https://usn.ubuntu.com/4014-1/https://usn.ubuntu.com/4014-2/http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.htmlhttps://access.redhat.com/errata/RHSA-2019:3530https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174https://lists.debian.org/debian-lts-announce/2019/06/msg00013.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/https://security.netapp.com/advisory/ntap-20190606-0003/https://usn.ubuntu.com/4014-1/https://usn.ubuntu.com/4014-2/
2019-05-29
Published