USN-841-1: GLib vulnerability

Releases

• Ubuntu 9.04
• Ubuntu 8.10
• Ubuntu 8.04

Packages

• glib2.0 -

Details

Arand Nash discovered that applications linked to GLib (e.g. Nautilus)
did not correctly copy symlinks. If a user copied symlinks with GLib,
the symlink target files would become world-writable, allowing local
attackers to gain access to potentially sensitive information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.04

• libglib2.0-0 - 2.20.1-0ubuntu2.1

Ubuntu 8.10

• libglib2.0-0 - 2.18.2-0ubuntu2.2

Ubuntu 8.04

• libglib2.0-0 - 2.16.6-0ubuntu1.2

After a standard system upgrade you need to restart your session to effect
the necessary changes.

References

• CVE-2009-3289