JLSEC-2025-154

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-154.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-154.json
JSON Data
https://api.osv.dev/v1/vulns/JLSEC-2025-154
Upstream
Published
2025-10-19T22:31:43.957Z
Modified
2026-07-23T22:30:11.037872197Z
Severity
Summary
The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using...
Details

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.

Database specific 
{
    "sources": [
        {
            "modified": "2026-06-17T02:15:55.167Z",
            "database_specific": {
                "status": "Modified"
            },
            "id": "CVE-2019-13012",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13012",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-13012",
            "imported": "2026-07-17T20:38:53.951Z",
            "published": "2019-06-28T15:15:10.970Z"
        }
    ],
    "license": "CC-BY-4.0"
}
References

Affected packages

Julia / Glib_jll

Package

Name
Glib_jll
Purl
pkg:julia/Glib_jll?uuid=7746bdde-850d-59dc-9ae8-88ece973131d

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.68.1+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-154.json"