Advisories » MGASA-2019-0214

Updated gvfs packages fix security vulnerabilities

Publication date: 21 Jul 2019
Modification date: 21 Jul 2019
Type: security
Affected Mageia releases : 6 , 7
CVE: CVE-2019-12447 , CVE-2019-12448 , CVE-2019-12449 , CVE-2019-12795

Description

Updated gvfs package fixes security vulnerabilities:

* daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid
  is not used (CVE-2019-12447).
* daemon/gvfsbackendadmin.c has race conditions because the admin backend
  doesn't implement query_info_on_read/write (CVE-2019-12448).
* daemon/gvfsbackendadmin.c mishandles a file's user and group ownership
  during move (and copy with G_FILE_COPY_ALL_METADATA) operations from
  admin:// to file:// URIs, because root privileges are unavailable
  (CVE-2019-12449).
* daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x
  before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server
  socket without configuring an authorization rule (CVE-2019-12795)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=25114
• https://usn.ubuntu.com/usn/usn-4053-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12447
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12448
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12449
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12795

SRPMS

7/core

• gvfs-1.40.1-4.1.mga7

6/core

• gvfs-1.32.1-1.2.mga6