CVE-2021-28153: Broadcom Brocade Fabric Operating System Firmware

Medium severity, CVSS 5.3. EPSS: 2.6% chance of exploitation in the next 30 days.

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

Affected products

• Broadcom Brocade Fabric Operating System Firmware: affected versions not specified
• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 33 only
• Gnome Glib: before 2.66.8 (fixed in 2.66.8)

Published 2021-03-11. Last modified 2026-06-17.