Mageia: 2019-0214 Critical: gvfs File Handling and Access Issues
mageia
July 21, 2019
Updated gvfs package fixes security vulnerabilities: * daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used (CVE-2019-12447)
Summary
Updated gvfs package fixes security vulnerabilities:
* daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid
is not used (CVE-2019-12447).
* daemon/gvfsbackendadmin.c has race conditions because the admin backend
doesn't implement query_info_on_read/write (CVE-2019-12448).
* daemon/gvfsbackendadmin.c mishandles a file's user and group ownership
during move (and copy with G_FILE_COPY_ALL_METADATA) operations from
admin:// to file:// URIs, because root privileges are unavailable
(CVE-2019-12449).
* daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x
before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server
socket without configuring an authorization rule (CVE-2019-12795)
References
- https://bugs.mageia.org/show_bug.cgi?id=25114
- https://ubuntu.com/security/notices/USN-4053-1
- https://www.cve.org/CVERecord?id=CVE-2019-12447
- https://www.cve.org/CVERecord?id=CVE-2019-12448
- https://www.cve.org/CVERecord?id=CVE-2019-12449
- https://www.cve.org/CVERecord?id=CVE-2019-12795
Topics Covered
Resolution
SRPMS
- 7/core/gvfs-1.40.1-4.1.mga7
- 6/core/gvfs-1.32.1-1.2.mga6
PREVIOUS
NEXT
Severity
critical
Lowest
Low
Medium
High
Critical
Publication date: 21 Jul 2019
URL: https://advisories.mageia.org/MGASA-2019-0214.html
Type: security
CVE: CVE-2019-12447,
CVE-2019-12448,
CVE-2019-12449,
CVE-2019-12795
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!