CVE-2021-3800 Information disclosure in Glib
An attacker can leak content from files owned by privileged users to unprivileged users via pkexec due to a flaw in Glib.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-3800?
CVE-2021-3800 is a medium-severity vulnerability in Debian Debian Linux, published on 23 Aug 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition.
Which versions are affected by CVE-2021-3800?
It affects 3 products.
Linux distribution packages (4)
glib2 SUSE:Linux Enterprise Server 12 SP5 | All versions | 2.48.2-12.25.1 |
glib2 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 2.48.2-12.25.1 |
glib2 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 2.48.2-12.25.1 |
glib2 SUSE:Linux Enterprise Workstation Extension 12 SP5 | All versions | 2.48.2-12.25.1 |
Products include Debian Debian Linux, Gnome Glib, Netapp Active Iq Unified Manager.
How do I fix CVE-2021-3800?
Upgrade to a fixed version.
Is CVE-2021-3800 being exploited?
There is no known exploitation of CVE-2021-3800 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLSA-2021-1640697102, CLSA-2022-1642083911, CLSA-2022-1642084196, DEBIAN-CVE-2021-3800, DLA-3110-1, GHSA-58w9-h6f7-f979 and 4 more.