公告ID: KYLIN-2019-13012
安全等级: 低级
产品: Kylin V3
发布日期: 2019年6月28日
CVE: CVE-2019-13012
CVSS3评分: 4.4
概述:
This issue affects glib2 as shipped with Kylin Enterprise Linux 6, 7 and 8 and was rated as having a Low security impact by Kylin Product Security team. Although Kylin Enterprise Linux versions above ships the vulnerable code the flaw itself is not currently exploitable due to the presence of another glib2 bug (rhbz#1728896). This bug avoid glib's 'keyfile' module to be loaded at glib2 initialization, thus the vulnerable code is currently unreachable. Kylin Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Low, and is not currently planned to be addressed in future updates. For additional information, refer to the Kylin Enterprise Linux Life Cycle: https://access.Kylin.com/support/policy/updates/errata/. For additional information, refer to the Issue Severity Classification: https://access.Kylin.com/security/updates/classification/. 描述:
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.59.1 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450. 系统版本:
KYLIN 3.3.x
KYLIN 3.4.x
受影响包列表:
glib2
glib2