{"id":"CVE-2019-3827","aliases":["DEBIAN-CVE-2019-3827","EUVD-2019-13449","GHSA-4782-6x7j-q79q","MGASA-2019-0080","RHSA-2019:1517","RHSA-2019:2145","SUSE-SU-2019:0438-1","UBUNTU-CVE-2019-3827","USN-3888-1","openSUSE-SU-2019:0261-1","openSUSE-SU-2024:10838-1"],"status":"published","title":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that...","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","severity":{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00364,"percentile":0.30445,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2019-02-11T00:00:00Z","modified":"2026-10-24T10:30:21Z","fixes":[{"ecosystem":"Debian:12","package":"gvfs","fixed_in":["1.38.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gvfs","fixed_in":["1.38.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gvfs","fixed_in":["1.38.1-3"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"gvfs","fixed_in":["1.32.1-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-afc","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-afc-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-afp","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-afp-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-archive","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-archive-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-client","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-client-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-debugsource","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-devel","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-fuse","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-fuse-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-goa","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-goa-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-gphoto2","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-gphoto2-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-mtp","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-mtp-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-smb","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-smb-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-afc-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-afp-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-archive-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-client-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-debugsource","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-fuse-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-goa-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-gphoto2-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-mtp-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-smb-debuginfo","fixed_in":["0:1.36.2-2.el8_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-afc","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-afp","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-archive","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-client","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-debuginfo","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-fuse","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-goa","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-gphoto2","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-mtp","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-smb","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-devel","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-tests","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-afc","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-afp","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-archive","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-client","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-debuginfo","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-devel","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-fuse","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-goa","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-gphoto2","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-mtp","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-smb","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-tests","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-afc","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-afp","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-archive","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-client","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-debuginfo","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-devel","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-fuse","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-goa","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-gphoto2","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-mtp","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-smb","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-tests","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-afc","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-afp","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-archive","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-client","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-debuginfo","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-devel","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-fuse","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-goa","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-gphoto2","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-mtp","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-smb","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-tests","fixed_in":["0:1.36.2-3.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"gvfs","fixed_in":["1.34.2.1-4.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"gvfs","fixed_in":["1.36.1-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"gvfs","fixed_in":["1.34.2.1-lp150.3.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.38.1-3"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.32.1-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-afc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-afc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-afp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-afp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-archive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-archive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-goa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-goa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-gphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-gphoto2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-mtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-mtp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gvfs-smb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-afc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-afp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-archive-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-fuse-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-goa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-gphoto2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-mtp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gvfs-smb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-2.el8_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-afc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-afp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-archive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-goa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-gphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-mtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gvfs-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-afc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-afp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-archive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-goa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-gphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-mtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gvfs-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-afc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-afp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-archive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-goa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-gphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-mtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gvfs-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-afc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-afp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-archive","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-fuse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-goa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-gphoto2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-mtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gvfs-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.36.2-3.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2.1-4.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-0ubuntu1.3"}]}],"versions":["1.34.1-1ubuntu1","1.34.1-1ubuntu3","1.34.1-1ubuntu4","1.34.1-2ubuntu2","1.35.91-1ubuntu1","1.35.91-1ubuntu2","1.36.0-1ubuntu1","1.36.1-0ubuntu1","1.36.1-0ubuntu1.1","1.36.1-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.1-0ubuntu1.3"}]}],"versions":["1.34.1-1ubuntu1","1.34.1-1ubuntu3","1.34.1-1ubuntu4","1.34.1-2ubuntu2","1.35.91-1ubuntu1","1.35.91-1ubuntu2","1.36.0-1ubuntu1","1.36.1-0ubuntu1","1.36.1-0ubuntu1.1","1.36.1-0ubuntu1.2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2.1-lp150.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gvfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.48.1-1.3"}]}],"bundled":5}],"products":[{"vendor":"[unknown]","product":"gvfs"},{"vendor":"gnome","product":"gvfs"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3827","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://gitlab.gnome.org/GNOME/gvfs/merge_requests/31","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1517","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2145","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3827","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4782-6x7j-q79q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3827","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0080.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24215","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Y43CRGATQPYWH2UXO6ZS7PYPCSZGTGED/","tags":["web"]},{"url":"https://usn.ubuntu.com/3888-1/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665578","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1517.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3827","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3827","tags":["advisory","report"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1619719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1632960","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2145.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190438-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125084","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3827","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-3827","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/gvfs/issues/355","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3888-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EHTJ6QR4Z76JZTPUEXBA4LH7I54YMIFE/#EHTJ6QR4Z76JZTPUEXBA4LH7I54YMIFE","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12795","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-3827","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","status":"published","published":"2019-03-25T17:47:35Z","modified":"2024-08-04T19:19:18.554Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13449","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","status":"published","published":"2019-03-25T17:47:35Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-4782-6x7j-q79q","title":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that...","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","status":"published","published":"2022-05-13T01:14:27Z","modified":"2023-02-01T05:04:16Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:50:08.411477Z"}],"nvd":[{"id":"CVE-2019-3827","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","status":"published","published":"2019-03-25T18:29:00.887Z","modified":"2026-06-17T02:35:40.36Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":3.3,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-3827","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","status":"published","published":"2019-03-25T18:29:00.887Z","modified":"2026-10-24T10:30:21.77278178Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3827","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","status":"published","published":"2019-03-25T18:29:00.887Z","modified":"2026-09-21T07:01:19.75130972Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2019:1517","title":"Red Hat Security Advisory: gvfs security update","status":"published","published":"2024-09-16T02:10:42Z","modified":"2026-06-26T12:22:03.499520441Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2145","title":"Red Hat Security Advisory: gvfs security and bug fix update","status":"published","published":"2024-09-16T02:10:36Z","modified":"2026-06-26T12:21:07.733866334Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"UBUNTU-CVE-2019-3827","description":"An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.","status":"published","published":"2019-02-11T00:00:00Z","modified":"2026-02-04T03:53:49.34976Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"MGASA-2019-0080","title":"Updated gvfs packages fix security vulnerability","description":"The backend currently allows to access and modify files without prompting\nfor password if any polkit authentication agent isn't available. This\naffects only users which belong to wheel group (i.e. those who are already\nallowed to use sudo). It doesn't allow privilege escalation for users, who\ndon't belong to that group (CVE-2019-3827).\n","status":"published","published":"2019-02-14T08:38:16Z","modified":"2026-04-16T04:43:27.595963119Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:0261-1","title":"Security update for gvfs","description":"This update for gvfs fixes the following issues:\n\nSecurity vulnerability fixed:\n\n- CVE-2019-3827: Fixed an issue whereby an unprivileged user was not prompted to\n  give a password when acessing root owned files. (bsc#1125084)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:08:31Z","modified":"2026-02-04T03:02:18.800634Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10838-1","title":"gvfs-1.48.1-1.3 on GA media","description":"These are all security issues fixed in the gvfs-1.48.1-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:10:30.889911Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:0438-1","title":"Security update for gvfs","description":"This update for gvfs fixes the following issues:\n\nSecurity vulnerability fixed:\n\n- CVE-2019-3827: Fixed an issue whereby an unprivileged user was not prompted to\n  give a password when acessing root owned files. (bsc#1125084)\n","status":"published","published":"2019-02-19T14:35:34Z","modified":"2026-02-04T02:49:26.001127Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3888-1","title":"gvfs vulnerability","description":"It was discovered that GVfs incorrectly handled certain inputs. An attacker\ncould possibly use this issue to access sensitive information.\n","status":"published","published":"2019-02-12T16:42:33Z","modified":"2026-02-10T04:41:28Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}