CVE-2019-12795: High severity Gnome gvfs vulnerability
daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)
Upstream commits: https://gitlab.gnome.org/GNOME/gvfs/commit/e3808a1b4042761055b1d975333a8243d67b8bfe https://gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-12795?
CVE-2019-12795 is a vulnerability in gvfsd from GNOME gvfs that allows a local attacker to connect to a private D-Bus server socket and issue D-Bus method calls.
How severe is CVE-2019-12795?
CVE-2019-12795 has a severity rating of 7.8 (high).
What is the affected software of CVE-2019-12795?
The affected software of CVE-2019-12795 includes gvfs versions before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3.
How can I fix CVE-2019-12795?
To fix CVE-2019-12795, update gvfs to at least version 1.38.3, 1.40.2, or 1.41.3 depending on the affected software version.
Where can I find more information about CVE-2019-12795?
You can find more information about CVE-2019-12795 at the following references: - http://www.securityfocus.com/bid/108741 - https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a - https://gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f