CVE-2009-3289

The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.

• CWE-732

• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.htmlThird Party Advisory
• http://secunia.com/advisories/39656Broken Link
• http://www.openwall.com/lists/oss-security/2009/09/08/8Mailing List
• http://www.vupen.com/english/advisories/2010/1001Permissions Required
• https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135Exploit, Issue Tracking
• https://bugzilla.gnome.org/show_bug.cgi?id=593406Exploit, Issue Tracking
• http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.htmlThird Party Advisory
• http://secunia.com/advisories/39656Broken Link
• http://www.openwall.com/lists/oss-security/2009/09/08/8Mailing List
• http://www.vupen.com/english/advisories/2010/1001Permissions Required
• https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135Exploit, Issue Tracking
• https://bugzilla.gnome.org/show_bug.cgi?id=593406Exploit, Issue Tracking

Published

Sep 22, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3282Integer overflow in the vmx86 kernel extension in VMware Fus…
• CVE-2009-3283Cross-site scripting (XSS) vulnerability in phpspot PHP BBS,…
• CVE-2009-3284Directory traversal vulnerability in phpspot PHP BBS, PHP Im…
• CVE-2009-3286NFSv4 in the Linux kernel 2.6.18, and possibly other version…
• CVE-2009-3287lib/thin/connection.rb in Thin web server before 1.2.4 relie…
• CVE-2009-3288The sg_build_indirect function in drivers/scsi/sg.c in Linux…
• CVE-2009-3290The kvm_emulate_hypercall function in arch/x86/kvm/x86.c in …
• CVE-2009-3291The php_openssl_apply_verification_policy function in PHP be…
• CVE-2009-3292Unspecified vulnerability in PHP before 5.2.11, and 5.3.x be…
• CVE-2009-3293Unspecified vulnerability in the imagecolortransparent funct…
• CVE-2009-3294The popen API function in TSRM/tsrm_win32.c in PHP before 5.…
• CVE-2009-3295The prep_reprocess_req function in kdc/do_tgs_req.c in the c…