SB2021071626 - Anolis OS update for glib2 (Anolis OS 8.4)

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Integer overflow (CVE-ID: CVE-2021-27219)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow within the g_bytes_new() function on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. A local user can run a specially crafted program to trigger an integer overflow and execute arbitrary code with elevated privileges.

2) Incorrect default permissions (CVE-ID: CVE-2019-13012)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-12450)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the application applies default directory permissions to files while copying them in file_copy_fallback() function in gio/gfile.c. A local user can interfere with the copying operation and gain access to otherwise restricted files, as the application applies correct access permissions after the file was copied only.

Such application behavior allows a local user to access potentially sensitive data or modify file contents in case directory permissions that were applied to the file allow such operations.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2021:0031