Advisories ยป MGASA-2019-0214

Updated gvfs packages fix security vulnerabilities

Publication date: 21 Jul 2019
Modification date: 21 Jul 2019
Type: security
Affected Mageia releases : 6 , 7
CVE: CVE-2019-12447 , CVE-2019-12448 , CVE-2019-12449 , CVE-2019-12795


Updated gvfs package fixes security vulnerabilities:

* daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid
  is not used (CVE-2019-12447).
* daemon/gvfsbackendadmin.c has race conditions because the admin backend
  doesn't implement query_info_on_read/write (CVE-2019-12448).
* daemon/gvfsbackendadmin.c mishandles a file's user and group ownership
  during move (and copy with G_FILE_COPY_ALL_METADATA) operations from
  admin:// to file:// URIs, because root privileges are unavailable
* daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x
  before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server
  socket without configuring an authorization rule (CVE-2019-12795)