CVE-2019-13012: High severity IBM Security Verify Access vulnerability
GNOME GLib could allow a local attacker to bypass security restrictions, caused by improper permission control in the keyfile settings backend. An attacker could exploit this vulnerability to bypass access restrictions.
Other sources
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.59.1 creates directories using gfilemakedirectorywithparents (kfsb->dir, NULL, NULL) and files using gfilereplacecontents (kfsb->file, contents, length, NULL, FALSE, GFILECREATEREPLACEDESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
Reference: https://gitlab.gnome.org/GNOME/glib/issues/1658
Upstream commit: https://gitlab.gnome.org/GNOME/glib/commit/5e4da714f00f6bfb2ccd6d73d61329c6f3a08429
— Red Hat
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using gfilemakedirectorywithparents (kfsb->dir, NULL, NULL) and files using gfilereplacecontents (kfsb->file, contents, length, NULL, FALSE, GFILECREATEREPLACEDESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/glib2.0to a version that resolves this vulnerability.Fixed in 2.66.8-1+deb11u4Fixed in 2.66.8-1+deb11u8Fixed in 2.74.6-2+deb12u8Fixed in 2.74.6-2+deb12u2Fixed in 2.84.4-3~deb13u2Fixed in 2.87.2-3 - Upgrade
Upgrade
GNOME GLibto a version that resolves this vulnerability.Fixed in 2.59.1 - Upgrade
Upgrade
GNOME GLibto a version that resolves this vulnerability.Fixed in 2.60.0
Event History
Frequently Asked Questions
What is CVE-2019-13012?
CVE-2019-13012 is a vulnerability in the GNOME GLib library that allows a local attacker to bypass security restrictions caused by improper permissions.
Which software is affected by CVE-2019-13012?
The affected software includes gnome/glib2.0 package versions 2.58.3-2+deb10u3, 2.58.3-2+deb10u5, 2.66.8-1, 2.74.6-2, and 2.78.0-2 from Debian, glib2.0 package version 2.56.4-0ubuntu0.18.04.4 from Ubuntu Bionic, glib2.0 package version 2.58.1-2ubuntu0.2 from Ubuntu Cosmic, glib2.0 package version 2.40.2-0ubuntu1.1+ from Ubuntu Trusty, glib2.0 package version 2.59.1 from Ubuntu upstream, and glib2.0 package version 2.48.2-0ubuntu4.4 from Ubuntu Xenial.
What is the severity of CVE-2019-13012?
CVE-2019-13012 has a severity rating of 7.5 (High).
How can I fix CVE-2019-13012?
To fix CVE-2019-13012, update the affected software to the respective patched versions: glib2.0 package versions 2.60.0 or later for Debian, glib2.0 package version 2.56.4-0ubuntu0.18.04.5 for Ubuntu Bionic, glib2.0 package version 2.58.1-2ubuntu0.3 for Ubuntu Cosmic, glib2.0 package version 2.40.2-0ubuntu1.2 for Ubuntu Trusty, glib2.0 package versions 2.59.2 or later for Ubuntu upstream, and glib2.0 package version 2.48.2-0ubuntu4.5 for Ubuntu Xenial.
Where can I find more information about CVE-2019-13012?
You can find more information about CVE-2019-13012 on the following references: [link1](https://gitlab.gnome.org/GNOME/glib/issues/1658), [link2](https://security-tracker.debian.org/tracker/CVE-2019-13012), [link3](https://security-tracker.debian.org/tracker/CVE-2019-12450).