AZL-91430
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91430.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-91430
- Upstream
- Published
- 2026-06-30T13:19:17Z
- Modified
- 2026-08-31T05:26:27Z
- Summary
- CVE-2026-58015 affecting package glib for versions less than 2.78.6-11
- Details
-
A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
- References