GNOME gvfs Multiple Security Vulnerabilities

Bugtraq ID:	109289
Class:	Unknown
CVE:	CVE-2019-12447 CVE-2019-12448 CVE-2019-12449
Remote:	Yes
Local:	No
Published:	May 23 2019 12:00AM
Updated:	May 23 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Ubuntu Ubuntu Linux 19.04 Ubuntu Ubuntu Linux 18.10 Ubuntu Ubuntu Linux 18.04 LTS Ubuntu Ubuntu Linux 16.04 LTS GNOME gvfs 1.41.2 GNOME gvfs 1.41 GNOME gvfs 1.40.3 GNOME gvfs 1.40.2 GNOME gvfs 1.40.1 GNOME gvfs 1.40 GNOME gvfs 1.38.3 GNOME gvfs 1.38.2 GNOME gvfs 1.38 GNOME gvfs 1.29.4 GNOME gvfs 1.30
Not Vulnerable:

GNOME gvfs Multiple Security Vulnerabilities

GNOME gvfs is prone to the following security vulnerabilities.

1. Multiple Security Bypass vulnerabilities

2. A race-condition vulnerability

Attackers can exploit these issues to bypass certain security restrictions, perform unauthorized actions or cause denial of service.

GNOME gvfs versions 1.29.4 through 1.41.2 are vulnerable.

GNOME gvfs Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GNOME gvfs Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GNOME gvfs Multiple Security Vulnerabilities

References:

• GNOME Homepage (GNOME)
  
• [CVE-2019-12447] : Allow changing file owner and Use fsuid to ensure correct fil (GNOME)
  
• [CVE-2019-12448] : Add query_info_on_read/write functionality (GNOME)
  
• [CVE-2019-12449] : Ensure correct ownership when moving to file:// uri (GNOME)
  
• USN-4053-1: GVfs vulnerabilities (Ubuntu)