CVE-2019-12447

Name of the Vulnerable Software and Affected Versions GVFS versions 1.29.4 through 1.41.2

Description The issue is related to errors in handling permissions in the daemon/gvfsbackendadmin.c component of the GVFS subsystem in the GNOME desktop environment for Linux operating systems. This can allow a remote attacker to impact the integrity, confidentiality, and availability of protected information. The problem arises because the setfsuid function is not used, leading to mishandling of file ownership.

Recommendations For GVFS versions 1.29.4 through 1.41.2, consider restricting access to the gvfsbackendadmin.c component until a patch is available. As a temporary workaround, avoid using the affected GVFS backend to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.