CVE-2019-12795

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)

GNOME is the default desktop environment of Rocky Linux.

Security Fix(es):

• evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail() (CVE-2019-11459)

• gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd (CVE-2019-12795)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.1 Release Notes linked from the References section.

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)

GNOME is the default desktop environment of AlmaLinux.

Security Fix(es):

• evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail() (CVE-2019-11459)

• gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd (CVE-2019-12795)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Updated gvfs package fixes security vulnerabilities:

• daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used (CVE-2019-12447).
• daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write (CVE-2019-12448).
• daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable (CVE-2019-12449).
• daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule (CVE-2019-12795)

This update for gvfs fixes the following issues:

Security issues fixed:

• CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930).
• CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986).
• CVE-2019-12449: Fixed an improper handling of file's user and group ownership
  in daemon/gvfsbackendadmin.c (bsc#1136992).
• CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981).

Other issue addressed:

• Drop polkit rules files that are only relevant for wheel group (bsc#1125433).

This update was imported from the SUSE:SLE-15:Update update project.

This update for gvfs fixes the following issues:

Security issues fixed:

• CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930).
• CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986).
• CVE-2019-12449: Fixed an improper handling of file's user and group ownership
  in daemon/gvfsbackendadmin.c (bsc#1136992).
• CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981).

Other issue addressed:

• Drop polkit rules files that are only relevant for wheel group (bsc#1125433).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the gvfs-1.48.1-1.3 package on the GA media of openSUSE Tumbleweed.

This update for gvfs fixes the following issues:

Security issues fixed:

• CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930).
• CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986).
• CVE-2019-12449: Fixed an improper handling of file's user and group ownership
  in daemon/gvfsbackendadmin.c (bsc#1136992).
• CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981).

Other issue addressed:

• Drop polkit rules files that are only relevant for wheel group (bsc#1125433).

This update for gvfs fixes the following issues:

• CVE-2019-12795: Fixed attack via local D-Bus method calls (bsc#1137930)

It was discovered that GVfs incorrectly handled the admin backend. Files created or moved by the admin backend could end up with the wrong ownership information, contrary to expectations. This issue only affected Ubuntu 18.04 LTS, Ubuntu 18.10, and Ubuntu 19.04. (CVE-2019-12447, CVE-2019-12448, CVE-2019-12449)

It was discovered that GVfs incorrectly handled authentication on its private D-Bus socket. A local attacker could possibly connect to this socket and issue D-Bus calls. (CVE-2019-12795)