תיאור (מקור, אנגלית)
An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)
מוצרים מושפעים
gnome: glib; broadcom: brocade fabric operating system firmware; debian: debian linux; fedoraproject: fedora
קישורים10
- gitlab.gnome.org/GNOME/glib/-/issues/2325 ExploitIssue TrackingPatchVendor Advisory
- gitlab.gnome.org/GNOME/glib/-/issues/2325 ExploitIssue TrackingPatchVendor Advisory
- lists.debian.org/debian-lts-announce/2022/06/msg00006.html Mailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists…
- lists.fedoraproject.org/archives/list/package-announce%40lists…
- security.gentoo.org/glsa/202107-13 Third Party Advisory
- security.netapp.com/advisory/ntap-20210416-0003/ Third Party Advisory
- lists.debian.org/debian-lts-announce/2022/06/msg00006.html Mailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists…
- lists.fedoraproject.org/archives/list/package-announce%40lists…
מדדים
- CVSS 3.1
-
5.3
MEDIUM
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - EPSS — סבירות ניצול
- 3% אחוזון 86 · נכון ל-6 בנובמבר 2026
- CWE
- CWE-59
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.