Updated gvfs package fixes security vulnerabilities: * daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used (CVE-2019-12447). * daemon/gvfsbackendadmin.c has race conditions because the admin backend
MGASA-2019-0214 - Updated gvfs packages fix security vulnerabilities Publication date: 21 Jul 2019
URL: https://advisories.mageia.org/MGASA-2019-0214.html
Type: security
Affected Mageia releases: 6, 7
CVE: CVE-2019-12447, CVE-2019-12448, CVE-2019-12449, CVE-2019-12795 Updated gvfs package fixes security vulnerabilities: * daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used (CVE-2019-12447).
* daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write (CVE-2019-12448).
* daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable (CVE-2019-12449).
* daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule (CVE-2019-12795) References:
- https://bugs.mageia.org/show_bug.cgi?id=25114
- https://usn.ubuntu.com/usn/usn-4053-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12447
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12448
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12449
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12795 SRPMS:
- 7/core/gvfs-1.40.1-4.1.mga7
- 6/core/gvfs-1.32.1-1.2.mga6
Support the originator by clicking the read the rest link below.
