Bugzilla – Bug 1136992
VUL-0: CVE-2019-12449: gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges
Last modified: 2019-07-16 06:02:43 UTC
CVE-2019-12449 An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-12449 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12449 https://gitlab.gnome.org/GNOME/gvfs/commit/d5dfd823c94045488aef8727c553f1e0f7666b90
Tracked as affected SLE15. Upstream fix at [1] For openSUSE LEAP 15.0 and 15.1 and TW are also affected. [1]https://gitlab.gnome.org/GNOME/gvfs/commit/d5dfd823c94045488aef8727c553f1e0f7666b90
SUSE-SU-2019:1717-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1125433,1136981,1136986,1136992,1137930 CVE References: CVE-2019-12447,CVE-2019-12448,CVE-2019-12449,CVE-2019-12795 Sources used: SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): gvfs-1.34.2.1-4.13.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src): gvfs-1.34.2.1-4.13.1 SUSE Linux Enterprise Module for Desktop Applications 15 (src): gvfs-1.34.2.1-4.13.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:1699-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1125433,1136981,1136986,1136992,1137930 CVE References: CVE-2019-12447,CVE-2019-12448,CVE-2019-12449,CVE-2019-12795 Sources used: openSUSE Leap 15.0 (src): gvfs-1.34.2.1-lp150.3.10.1
openSUSE-SU-2019:1697-1: An update that solves four vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1125433,1136981,1136986,1136992,1137930 CVE References: CVE-2019-12447,CVE-2019-12448,CVE-2019-12449,CVE-2019-12795 Sources used: openSUSE Leap 15.1 (src): gvfs-1.34.2.1-lp151.6.3.1
done