A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
References
Configurations
Configuration 1 (hide)
|
History
29 Oct 2026, 23:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Oct 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
14 Oct 2026, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 Oct 2026, 09:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
12 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Oct 2026, 04:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
06 Oct 2026, 03:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Oct 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Oct 2026, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Oct 2026, 00:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
01 Oct 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Sep 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Sep 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Sep 2026, 01:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Sep 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Sep 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
28 Sep 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2026-06-30 13:19
Updated : 2026-10-30 08:16
NVD link : CVE-2026-58015
Mitre link : CVE-2026-58015
CVE.ORG link : CVE-2026-58015
JSON object : View
Products Affected
redhat
- enterprise_linux
gnome
- glib
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
NVD-CWE-noinfo