CVE-2019-12450: Race Condition
filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 creates new files with default permissions and set the correct permissions after the operation is finished. This might cause that the files can be accessible by more users during the operation than expected.
Upstream Commit:
https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174
Other sources
filecopyfallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
— Launchpad
GNOME GLib could allow a remote attacker to bypass security restrictions, caused by improper permission control in the filecopyfallback in gio/gfile.c. An attacker could exploit this vulnerability to bypass access restrictions.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-12450?
CVE-2019-12450 is a vulnerability in GNOME GLib 2.15.0 through 2.61.1 that allows a remote attacker to bypass security restrictions.
How does CVE-2019-12450 affect IBM Security Guardium?
CVE-2019-12450 affects IBM Security Guardium versions 10.5 through 11.3.
How does CVE-2019-12450 affect the glib2.0 package in Ubuntu?
CVE-2019-12450 affects the glib2.0 package in Ubuntu versions disco (2.60.0-1ubuntu0.1), bionic (2.56.4-0ubuntu0.18.04.3), and cosmic (2.58.1-2ubuntu0.1).
What is the severity of CVE-2019-12450?
CVE-2019-12450 has a severity rating of critical (9.8).
Where can I find more information about CVE-2019-12450?
You can find more information about CVE-2019-12450 in the references: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.html, https://access.redhat.com/errata/RHSA-2019:3530, https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174.