CVE-2019-13012 describes a vulnerability in GNOME GLib (glib2.0) versions prior to 2.60.0, where the keyfile settings backend improperly sets permissions for newly created directories and files. Specifically, directories are created with insecure 0777 permissions, and files use default permissions, potentially exposing sensitive data. This flaw carries a CVSSv3 score of 7.5 (High), indicating a network-exploitable vulnerability with low attack complexity that could lead to high integrity impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.0.0, < 2.59.1CPE matchmatch criteria | cpe:2.3:a:gnome:glib:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2019-13012
Aug 11, 2020glib2: insecure permissions for files and directories
Jun 28, 2019The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir NULL NULL) and files using g_file_replace_contents (kfsb->file contents length NULL FALSE G_FILE_CREATE_REPLACE_DESTINATION NULL NULL NULL). Consequently it does not properly restrict directory (and file) permissions. Instead for directories 0777 permissions are used; for files default file permissions are used. This is similar to CVE-2019-12450.
Jun 11, 2019