CVE-2019-12449: Medium severity Gnome gvfs vulnerability
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with GFILECOPYALLMETADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gvfsto a version that resolves this vulnerability.Fixed in 1.46.2-1Fixed in 1.50.3-1Fixed in 1.57.2-2Fixed in 1.58.0-2Fixed in 1.59.1-1
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-12449.
What is the severity of CVE-2019-12449?
The severity of CVE-2019-12449 is medium with a CVSS score of 5.7.
How does CVE-2019-12449 affect GNOME gvfs?
CVE-2019-12449 affects GNOME gvfs versions 1.29.4 through 1.41.2.
What is the impact of CVE-2019-12449?
CVE-2019-12449 allows an attacker to mishandle a file's user and group ownership during move and copy operations, potentially leading to unauthorized access or privilege escalation.
Is there a fix for CVE-2019-12449?
Yes, there are updates available for each affected version of GNOME gvfs.