7.5

CVE-2019-13012: gnome glib

CVSS: 7.5v3.0HighModified
AliasesSUSE-SU-2019:1824-1SUSE-SU-2019:1830-1SUSE-SU-2019:1830-2
Published 28-06-2019Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2019-13012 is a high (CVSS 7.5) vulnerability in gnome glib. EPSS estimates a 3.21% chance of exploitation in the next 30 days, higher than 87.9% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (NVD)
EPSS score
3.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
DLA-1866-1RHSA-2021:1586USN-4049-3USN-4049-4

Timeline

  1. 28-06-2019
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

3.21%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.21% on 19-09-2026

19-09-202619-10-2026
EPSS score
3.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse23 products
  • glib2&distro=HPE Helion OpenStack 8< 2.48.2-12.15.1
  • glib2&distro=SUSE Enterprise Storage 4< 2.48.2-12.15.1
  • glib2&distro=SUSE Enterprise Storage 5< 2.48.2-12.15.1
  • glib2&distro=SUSE Linux Enterprise Desktop 12 SP4< 2.48.2-12.15.1
  • glib2&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.54.3-4.18.1
Debian1 product
  • glib2.0< 2.60.5-1 | < 2.42.1-1+deb8u3
Gnome1 product
  • glib≥ 2.0.0, < 2.59.1
Opensuse1 product
  • glib2&distro=openSUSE Leap 15.0< 2.54.3-lp150.3.13.1
Ubuntu1 product
  • glib2.0< 2.40.2-0ubuntu1.1+esm3 | < 2.48.2-0ubuntu4.4 | < 2.48.2-0ubuntu4.3 | < 2.56.4-0ubuntu0.18.04.4 | < 2.40.2-0ubuntu1.1+esm2

5 vendors · 27 products

References

28 links
Show all 28 references