Vulnerability in GNOME Gvfs
CVE-2019-12795
daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (30.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 30th percentile — 30.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
Weakness classification (CWE)
References
- gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a (Patch, Vendor Advisory)
- gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f (Patch, Vendor Advisory)
- gitlab.gnome.org/GNOME/gvfs/commit/e3808a1b4042761055b1d975333a8243d67b8bfe (Patch, Vendor Advisory)
- www.securityfocus.com/bid/108741 (vdb-entry)
- lists.debian.org/debian-lts-announce/2019/06/msg00014.html (mailing-list)
- lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html (vendor-advisory)
- lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html (vendor-advisory)
- usn.ubuntu.com/4053-1/ (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
Frequently asked questions
- What is CVE-2019-12795?
- CVE-2019-12795 is a high-severity vulnerability in GNOME Gvfs, classified under Incorrect Default Permissions. CVSS score: 7.8/10. Published 2019-06-11.
- How severe is CVE-2019-12795?
- High severity. CVSS v3 base score is 7.8 out of 10.