CVE-2019-12449

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with GFILECOPYALLMETADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.

References

Affected packages

Git / github.com/gnome/gvfs

Affected ranges

Type: GIT
Repo: https://github.com/gnome/gvfs
Events: Introduced

8baec79ab9cb2cb86095b071f3a40f7f6a751ef6

Affected versions

1.*

1.29.4

1.29.90

1.29.91

1.29.92

1.30.0

1.30.1

1.30.1.1

1.30.2

1.30.3

1.30.4

1.31.1

1.31.2

1.31.3

1.31.4

1.31.90

1.31.91

1.31.92

1.32.0

1.32.1

1.32.2

1.33.1

1.33.3

1.33.90

1.33.91

1.33.92

1.34.0

1.34.1

1.34.2

1.34.2.1

1.35.1

1.35.2

1.35.3

1.35.4

1.35.90

1.35.91

1.35.92

1.36.0

1.36.1

1.36.2

1.36.3

1.37.1

1.37.2

1.37.4

1.37.90

1.37.91

1.38.0

1.38.1

1.38.2

1.38.3

1.39.1

1.39.3

1.39.4

1.39.90

1.39.91

1.39.92

1.40.0

1.40.1

1.40.2

1.41.1

1.41.2

1.41.3

1.41.4

1.41.90

1.41.91

1.42.0

1.42.1

1.42.2

1.43.1

1.43.2

1.43.90

1.43.91

1.43.92

1.44.0

1.44.1

1.45.2

1.45.3

1.45.90

1.45.92

1.46.0

1.46.1

1.46.2

1.47.1

1.47.90

1.47.91

1.48.0

1.48.1

1.48.2

1.49.1

1.49.90

1.50.0

1.50.1

1.50.2

1.50.3

1.50.4

1.50.5

1.50.6

1.50.7

1.51.1

1.51.90

1.51.91

1.52.0

1.52.1

1.52.2

1.52.3

1.53.1

1.53.90

1.53.91

1.54.0

1.54.1

1.54.2

1.54.3

1.54.4

1.55.1

1.55.90

1.56.0

1.56.1

1.57.1

1.57.2

1.58.0

Git / gitlab.gnome.org/GNOME/gvfs

Affected ranges

Type: GIT
Repo: https://gitlab.gnome.org/GNOME/gvfs
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

409619412e11be146a31b9a99ed965925f1aabb8

Affected versions

1.*

1.10.0

1.11.0

1.11.1

1.11.2

1.11.3

1.11.4

1.11.5

1.12.0

1.12.1

1.13.0

1.13.1

1.13.2

1.13.3

1.13.4

1.13.5

1.13.6

1.13.7

1.13.8

1.13.9

1.14.0

1.15.0

1.15.1

1.15.2

1.15.3

1.15.4

1.16.0

1.17.0

1.17.1

1.17.2

1.17.3

1.17.90

1.18.0

1.18.1

1.18.2

1.19.1

1.19.2

1.19.3

1.19.4

1.19.5

1.19.90

1.20.0

1.21.1

1.21.2

1.21.3

1.21.4

1.21.90

1.21.92

1.22.0

1.23.1

1.23.2

1.23.3

1.23.4

1.23.90

1.23.92

1.24.0

1.25.1

1.25.2

1.25.3

1.25.4

1.25.4.1

1.25.90

1.25.91

1.25.92

1.26.0

1.26.1

1.26.1.1

1.26.2

1.27.3

1.27.4

1.27.90

1.27.91

1.27.92

1.28.0

1.28.1

1.29.1

1.29.2

1.29.3

1.29.4

1.29.90

1.29.91

1.29.92

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.30.0

1.31.1

1.31.2

1.31.3

1.31.4

1.31.90

1.31.91

1.31.92

1.32.0

1.33.1

1.33.3

1.33.90

1.33.91

1.33.92

1.34.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.90

1.35.91

1.35.92

1.36.0

1.37.1

1.37.2

1.37.4

1.37.90

1.37.91

1.38.0

1.39.1

1.39.3

1.39.4

1.39.90

1.39.91

1.39.92

1.4.0

1.40.0

1.41.1

1.41.2

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.7.0

1.7.1

1.7.2

1.7.3

1.9.0

1.9.1

1.9.2

1.9.3

1.9.4

1.9.5

Other

GVFS_0_0_1

GVFS_0_0_2

GVFS_0_1_0

GVFS_0_1_1

GVFS_0_1_10

GVFS_0_1_11

GVFS_0_1_2

GVFS_0_1_3

GVFS_0_1_4

GVFS_0_1_5

GVFS_0_1_6

GVFS_0_1_7

GVFS_0_1_8

GVFS_0_1_9

GVFS_0_2_0

GVFS_0_2_0_1

GVFS_0_2_1

GVFS_0_2_2

GVFS_0_2_4

GVFS_0_99_1

GVFS_0_99_2

GVFS_0_99_3

GVFS_0_99_4

GVFS_0_99_5

GVFS_0_99_6

GVFS_0_99_7

GVFS_1_1_1

GVFS_1_1_2

GVFS_1_1_3

GVFS_1_1_4

GVFS_1_1_5

GVFS_1_1_6

GVFS_1_1_7

GVFS_1_1_8

GVFS_1_2_1

GVFS_1_2_2

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 1225.0,
            "function_hash": "231020120805253815594800467972206124585"
        },
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/GNOME/gvfs@409619412e11be146a31b9a99ed965925f1aabb8",
        "target": {
            "file": "daemon/gvfsbackendadmin.c",
            "function": "g_vfs_backend_admin_class_init"
        },
        "id": "CVE-2019-12449-42bca7d7"
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "188400266217883493317486595327510648447",
                "84370787118236718112280869999792270972",
                "235841846821089703407745877082633987750",
                "22225832117781730001295094493184023477",
                "10481938479286945038407544721119377788",
                "223840719794277329878536154385692187910",
                "85960072603906379813090528892411735538"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "source": "https://gitlab.gnome.org/GNOME/gvfs@409619412e11be146a31b9a99ed965925f1aabb8",
        "target": {
            "file": "daemon/gvfsbackendadmin.c"
        },
        "id": "CVE-2019-12449-e6d26694"
    }
]