The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using gfilemakedirectorywithparents (kfsb->dir, NULL, NULL) and files using gfilereplacecontents (kfsb->file, contents, length, NULL, FALSE, GFILECREATEREPLACEDESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "medium", "binaries": [ { "libglib2.0-0": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-tests-dbgsym": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-0-refdbg": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-0-dbg": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-bin": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-dev-dbgsym": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-udeb-dbgsym": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-doc": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-0-dbgsym": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-data": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-tests": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-udeb": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-dev": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-bin-dbgsym": "2.40.2-0ubuntu1.1+esm3", "libglib2.0-0-refdbg-dbgsym": "2.40.2-0ubuntu1.1+esm3" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libglib2.0-0": "2.48.2-0ubuntu4.4", "libglib2.0-tests-dbgsym": "2.48.2-0ubuntu4.4", "libglib2.0-0-refdbg": "2.48.2-0ubuntu4.4", "libglib2.0-0-dbg": "2.48.2-0ubuntu4.4", "libglib2.0-bin": "2.48.2-0ubuntu4.4", "libglib2.0-dev-dbgsym": "2.48.2-0ubuntu4.4", "libglib2.0-udeb-dbgsym": "2.48.2-0ubuntu4.4", "libglib2.0-doc": "2.48.2-0ubuntu4.4", "libglib2.0-0-dbgsym": "2.48.2-0ubuntu4.4", "libglib2.0-data": "2.48.2-0ubuntu4.4", "libglib2.0-tests": "2.48.2-0ubuntu4.4", "libglib2.0-udeb": "2.48.2-0ubuntu4.4", "libglib2.0-dev": "2.48.2-0ubuntu4.4", "libglib2.0-bin-dbgsym": "2.48.2-0ubuntu4.4", "libglib2.0-0-refdbg-dbgsym": "2.48.2-0ubuntu4.4" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "libglib2.0-data": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-doc": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-0-dbgsym": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-dev": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-0": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-dev-bin-dbgsym": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-tests": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-udeb": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-dev-bin": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-bin-dbgsym": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-tests-dbgsym": "2.56.4-0ubuntu0.18.04.4", "libglib2.0-bin": "2.56.4-0ubuntu0.18.04.4" } ] }