CVE-2019-13012: High severity IBM Security Verify Access vulnerability
GNOME GLib could allow a local attacker to bypass security restrictions, caused by improper permission control in the keyfile settings backend. An attacker could exploit this vulnerability to bypass access restrictions.
Other sources
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.59.1 creates directories using gfilemakedirectorywithparents (kfsb->dir, NULL, NULL) and files using gfilereplacecontents (kfsb->file, contents, length, NULL, FALSE, GFILECREATEREPLACEDESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
Reference: https://gitlab.gnome.org/GNOME/glib/issues/1658
Upstream commit: https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429
— Red Hat
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using gfilemakedirectorywithparents (kfsb->dir, NULL, NULL) and files using gfilereplacecontents (kfsb->file, contents, length, NULL, FALSE, GFILECREATEREPLACEDESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-13012?
CVE-2019-13012 is a vulnerability in the GNOME GLib library that allows a local attacker to bypass security restrictions caused by improper permissions.
Which software is affected by CVE-2019-13012?
The affected software includes gnome/glib2.0 package versions 2.58.3-2+deb10u3, 2.58.3-2+deb10u5, 2.66.8-1, 2.74.6-2, and 2.78.0-2 from Debian, glib2.0 package version 2.56.4-0ubuntu0.18.04.4 from Ubuntu Bionic, glib2.0 package version 2.58.1-2ubuntu0.2 from Ubuntu Cosmic, glib2.0 package version 2.40.2-0ubuntu1.1+ from Ubuntu Trusty, glib2.0 package version 2.59.1 from Ubuntu upstream, and glib2.0 package version 2.48.2-0ubuntu4.4 from Ubuntu Xenial.
What is the severity of CVE-2019-13012?
CVE-2019-13012 has a severity rating of 7.5 (High).
How can I fix CVE-2019-13012?
To fix CVE-2019-13012, update the affected software to the respective patched versions: glib2.0 package versions 2.60.0 or later for Debian, glib2.0 package version 2.56.4-0ubuntu0.18.04.5 for Ubuntu Bionic, glib2.0 package version 2.58.1-2ubuntu0.3 for Ubuntu Cosmic, glib2.0 package version 2.40.2-0ubuntu1.2 for Ubuntu Trusty, glib2.0 package versions 2.59.2 or later for Ubuntu upstream, and glib2.0 package version 2.48.2-0ubuntu4.5 for Ubuntu Xenial.
Where can I find more information about CVE-2019-13012?
You can find more information about CVE-2019-13012 on the following references: [link1](https://gitlab.gnome.org/GNOME/glib/issues/1658), [link2](https://security-tracker.debian.org/tracker/CVE-2019-13012), [link3](https://security-tracker.debian.org/tracker/CVE-2019-12450).