CVE-2019-12449

MEDIUM 5.7CVE-2019-12449 · Published 29/05/2019 · updated 17/06/2026

In short

CVE-2019-12449 is a MEDIUM (CVSS 5.7) vulnerability affecting gvfs (gnome).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
gvfs gnome	`≥ 1.29.4, ≤ 1.41.2`	No fix yet

Description

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.

References

lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html · Third Party Advisory
openwall.com/lists/oss-security/2019/07/09/3 · Mailing List
gitlab.gnome.org/GNOME/gvfs/commit/409619412e11be146a31b9a99ed965925f1aabb8 · Patch
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2
usn.ubuntu.com/4053-1 · Third Party Advisory

More vulnerabilities in gvfs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

gvfs

gnome

≥ 1.29.4, ≤ 1.41.2

No fix yet

More vulnerabilities in gvfs

See all →