MGASA-2021-0318 - Updated glib2.0 packages fix security vulnerabilities Publication date: 08 Jul 2021 URL: https://advisories.mageia.org/MGASA-2021-0318.html Type: security Affected Mageia releases: 7 CVE: CVE-2021-27218, CVE-2021-27219, CVE-2021-28153 Krzesimir Nowak discovered that GLib incorrectly handled certain large buffers. A remote attacker could use this issue to cause applications linked to GLib to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2021-27218). Kevin Backhouse discovered that GLib incorrectly handled certain memory allocations. A remote attacker could use this issue to cause applications linked to GLib to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2021-27219). It was discovered that GLib incorrectly handled certain symlinks when replacing files. If a user or automated system were tricked into extracting a specially crafted file with File Roller, a remote attacker could possibly create files outside of the intended directory (CVE-2021-28153). References: - https://bugs.mageia.org/show_bug.cgi?id=28520 - https://ubuntu.com/security/notices/USN-4759-1 - https://ubuntu.com/security/notices/USN-4764-1 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27218 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27219 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28153 SRPMS: - 7/core/glib2.0-2.60.2-1.5.mga7