Back to CVE Browser

CVE-2009-3289

HIGH

7.8

CVSS Severity Score

EPSS Score0.1910%

EPSS Percentile15.04th

PublishedSep 22, 2009

Last ModifiedApr 23, 2026

Vulnerability Description

The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.

Affected Platforms (CPE)

📦

Gnome

Glib

= 2.0

💻

Opensuse

Opensuse

= 11.0

💻

Opensuse

Opensuse

= 11.1

💻

Suse

Suse Linux Enterprise Server

= 11

References & Advisories

🔗 http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html

🔗 http://secunia.com/advisories/39656

🔗 http://www.openwall.com/lists/oss-security/2009/09/08/8

🔗 http://www.vupen.com/english/advisories/2010/1001

🔗 https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135

🔗 https://bugzilla.gnome.org/show_bug.cgi?id=593406

🔗 http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html

🔗 http://secunia.com/advisories/39656

Related Vulnerabilities

CVE-2018-164289.8

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.

CVE-2019-124509.8

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy ope...

CVE-2020-354577.8

GNOME GLib before 2.65.3 has an integer overflow, that might lead to an out-of-bounds write, in g_option_group_add_entries. NOTE: ...

CVE-2021-408277.8

Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL is used) is vulnerable to a Read Access Violation on Block Data Move,...