Homepage

Incorrect Default Permissions The advisory has been revoked - it doesn't affect any version of package gvfs-32bit  (opens in a new tab)

Threat Intelligence

EPSS
0.39% (33rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES151-GVFS32BIT-2745633
  • published14 Apr 2022
  • disclosed1 Jul 2019
Report a new vulnerability Found a mistake?

Introduced: 1 Jul 2019

CVE-2019-12795  (opens in a new tab)
CWE-276  (opens in a new tab)

Amendment

The SLES security team deemed this advisory irrelevant for SLES:15.1.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gvfs-32bit package and not the gvfs-32bit package as distributed by SLES.

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)

References