Race Condition Vulnerability in GNOME gvfs Affected by Privileged Access Flaw
CVE-2019-12448

8.1HIGH

Key Information:

Vendor

Gnome
Status
Gvfs
Vendor
CVE Published:
29 May 2019

What is CVE-2019-12448?

A vulnerability in GNOME gvfs versions 1.29.4 to 1.41.2 presents a race condition due to the admin backend's lack of implementation for query_info_on_read/write operations. This oversight can lead to unauthorized access to privileged files, enabling malicious users or applications to exploit this flaw for potential data leakage or unauthorized modifications.

References

http://lists.opensuse.org/opensuse-security-announce/2019...
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2019...
vendor-advisoryx_refsource_SUSE
https://usn.ubuntu.com/4053-1/
vendor-advisoryx_refsource_UBUNTU

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.