CVE-2019-12450 Race condition in n/a
A race condition in GLib's file copy function allows attackers to read or modify files due to improper permission restrictions during the operation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-12450?
CVE-2019-12450 is a critical vulnerability in Canonical Ubuntu Linux, published on 29 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
Which versions are affected by CVE-2019-12450?
It affects 9 products.
Linux distribution packages (22)
glib2 Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-devel-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-fam Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-fam-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-tests Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-tests-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:2.56.4-7.el8 |
glib2-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-7.el8 |
glib2-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-7.el8 |
glib2-devel-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-7.el8 |
glib2-doc Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-7.el8 |
glib2-fam-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-7.el8 |
glib2-static Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-7.el8 |
glib2-tests-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:2.56.4-7.el8 |
glib2 SUSE:Linux Enterprise Module for Basesystem 15 | All versions | 2.54.3-4.15.1 |
glib2 SUSE:Linux Enterprise Module for Basesystem 15 SP1 | All versions | 2.54.3-4.15.1 |
glib2 SUSE:Linux Enterprise Module for Package Hub 15 | All versions | 2.54.3-4.15.1 |
glib2 SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 2.22.5-0.8.39.1 |
glib2 SUSE:Linux Enterprise Server 11 SP4-LTSS | All versions | 2.22.5-0.8.39.1 |
glib2 openSUSE:Leap 15.0 | All versions | 2.54.3-lp150.3.10.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Gnome Glib, Opensuse Leap, Redhat Enterprise Linux and 3 more.
How do I fix CVE-2019-12450?
Apply the vendor's patch.
Is CVE-2019-12450 being exploited?
There is no known exploitation of CVE-2019-12450 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2019-12450, AZL-6434, CLEANSTART-2026-SB14639, DEBIAN-CVE-2019-12450, DLA-1826-1, GHSA-m54p-gqx6-f2r7 and 9 more.