CVE-2019-12447

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-12447
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12447.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-12447
Downstream
ALPINE (1)
DEBIAN (1)
MGASA (1)
openSUSE (3)
RHSA (1)
RLSA (1)
SUSE (1)
UBUNTU (1)
Related
ALSA (1)
openSUSE (3)
SUSE (1)
Published
2019-05-29T17:29:00Z
Modified
2026-10-22T07:11:13Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "16.04"
                        },
                        {
                            "last_affected":  "16.04"
                        },
                        {
                            "introduced":  "18.04"
                        },
                        {
                            "last_affected":  "18.04"
                        },
                        {
                            "introduced":  "18.10"
                        },
                        {
                            "last_affected":  "18.10"
                        },
                        {
                            "introduced":  "19.04"
                        },
                        {
                            "last_affected":  "19.04"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "canonical:ubuntu_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "29"
                        },
                        {
                            "last_affected":  "29"
                        },
                        {
                            "introduced":  "30"
                        },
                        {
                            "last_affected":  "30"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "fedoraproject:fedora"
        },
        {
            "cpes":  [
                "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "15.0"
                        },
                        {
                            "last_affected":  "15.0"
                        },
                        {
                            "introduced":  "15.1"
                        },
                        {
                            "last_affected":  "15.1"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "opensuse:leap"
        }
    ]
}
References

Affected packages

Git / gitlab.gnome.org/gnome/gvfs

Affected ranges

Type
GIT
Repo
https://gitlab.gnome.org/gnome/gvfs
Events
Introduced
8baec79ab9cb2cb86095b071f3a40f7f6a751ef6
Last Affected
769d0b47a88eff3ca14d34346491b2961e17ecd5
Fixed
d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:gnome:gvfs:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.29.4"
                },
                {
                    "last_affected":  "1.41.2"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.29.4
1.29.90
1.29.91
1.29.92
1.30.0
1.31.1
1.31.2
1.31.3
1.31.4
1.31.90
1.31.91
1.31.92
1.32.0
1.33.1
1.33.3
1.33.90
1.33.91
1.33.92
1.34.0
1.35.1
1.35.2
1.35.3
1.35.4
1.35.90
1.35.91
1.35.92
1.36.0
1.37.1
1.37.2
1.37.4
1.37.90
1.37.91
1.38.0
1.39.1
1.39.3
1.39.4
1.39.90
1.39.91
1.39.92
1.40.0
1.41.1
1.41.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12447.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "320077015584121439858559977796245338654",
            "length":  483
        },
        "id":  "CVE-2019-12447-5aa4fbd5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/gvfs@d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80",
        "target":  {
            "file":  "daemon/gvfsbackendadmin.c",
            "function":  "acquire_caps"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "73916177003641685572968591140627056112",
                "253018699655399886978684173833991900463",
                "32636196277512700844917516674410904213",
                "60225804736163445770261030020149093149",
                "295188651935798861711237930154468362773",
                "336949180031531535903300586715887847111",
                "122733523442005799036535946978199199215",
                "38715005556965058985949591750549156080",
                "190219455231647675840419608914300357934",
                "130958840252877500505001559892379322624",
                "84226649914448015677384007816104284654",
                "298302122726318424865405617214389136455",
                "193864371884430685022515345336037369450",
                "107778891356980170510552533430107576593",
                "140936156180911864638887877595746396694",
                "45125191213936464693370036745465389237",
                "193864371884430685022515345336037369450",
                "107778891356980170510552533430107576593",
                "140936156180911864638887877595746396694",
                "45125191213936464693370036745465389237",
                "193864371884430685022515345336037369450",
                "107778891356980170510552533430107576593",
                "140936156180911864638887877595746396694",
                "199385678116433857180824745464754018949",
                "308700058573000777060027644789832722692",
                "258936626926811761635742473922404076168",
                "298306042285414535072862238550100067832",
                "38621369527279116206907721802346232539",
                "247610009810254618915339530098308913622",
                "276737675418966760951910999472124881363"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2019-12447-6594e110",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/gvfs@d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80",
        "target":  {
            "file":  "daemon/gvfsbackendadmin.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "221129427121838919402311318763590252207",
            "length":  543
        },
        "id":  "CVE-2019-12447-bb7e6c47",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/gvfs@d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80",
        "target":  {
            "file":  "daemon/gvfsbackendadmin.c",
            "function":  "do_query_info"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "102790847050225268433877757460925083898",
            "length":  300
        },
        "id":  "CVE-2019-12447-c7d919f4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/gvfs@d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80",
        "target":  {
            "file":  "daemon/gvfsbackendadmin.c",
            "function":  "fix_file_info"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "315758984730309787526684648289640819509",
            "length":  399
        },
        "id":  "CVE-2019-12447-caa3c2f6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/gvfs@d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80",
        "target":  {
            "file":  "daemon/gvfsbackendadmin.c",
            "function":  "do_query_info_on_read"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "315758984730309787526684648289640819509",
            "length":  399
        },
        "id":  "CVE-2019-12447-f9a4f056",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.gnome.org/gnome/gvfs@d7d362995aa0cb8905c8d5c2a2a4c305d2ffff80",
        "target":  {
            "file":  "daemon/gvfsbackendadmin.c",
            "function":  "do_query_info_on_write"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T07:11:13Z"