CVE-2019-12795
- State
- Published
- Severity
- Not scored
- Published
- Jun 11, 2019
- Updated
- Aug 4, 2024
- Reserved
- Jun 11, 2019
Description
daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a
- https://gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f
- https://gitlab.gnome.org/GNOME/gvfs/commit/e3808a1b4042761055b1d975333a8243d67b8bfe
- 108741vdb-entry
- [debian-lts-announce] 20190619 [SECURITY] [DLA 1827-1] gvfs security updatemailing-list
- openSUSE-SU-2019:1699vendor-advisory
- openSUSE-SU-2019:1697vendor-advisory
- USN-4053-1vendor-advisory
- FEDORA-2019-6ed5523cc0vendor-advisory
- FEDORA-2019-e6b02af8b8vendor-advisory
- RHSA-2019:3553vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.