Vulnerability-Lookup

alsa-2019:3553

Vulnerability from osv_almalinux

Published

2019-11-05 17:59

Modified

2021-11-12 10:20

Summary

Low: GNOME security, bug fix, and enhancement update

Details

GNOME is the default desktop environment of AlmaLinux.

Security Fix(es):

evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail() (CVE-2019-11459)
gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd (CVE-2019-12795)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "gdk-pixbuf2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.36.12-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "gdk-pixbuf2-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.36.12-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "gdk-pixbuf2-modules"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.36.12-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "gdk-pixbuf2-xlib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.36.12-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "gdk-pixbuf2-xlib-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.36.12-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "gnome-desktop3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.32.2-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "gnome-desktop3-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.32.2-1.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libpurple"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "libpurple-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "pidgin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:8",
        "name": "pidgin-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0-5.el8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "GNOME is the default desktop environment of AlmaLinux.\n\nSecurity Fix(es):\n\n* evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail() (CVE-2019-11459)\n\n* gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd (CVE-2019-12795)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.",
  "id": "ALSA-2019:3553",
  "modified": "2021-11-12T10:20:55Z",
  "published": "2019-11-05T17:59:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/8/ALSA-2019-3553.html"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-11070"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-11459"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-12795"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-3820"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-6237"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-6251"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8506"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8518"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8523"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8524"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8535"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8536"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8544"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8551"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8558"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8559"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8563"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8571"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8583"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8584"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8586"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8587"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8594"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8595"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8596"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8597"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8601"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8607"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8608"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8609"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8610"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8611"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8615"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8619"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8622"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8623"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8666"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8671"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8672"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8673"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8676"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8677"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8679"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8681"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8686"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8687"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8689"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8690"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8726"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8735"
    },
    {
      "type": "REPORT",
      "url": "https://vulners.com/cve/CVE-2019-8768"
    }
  ],
  "related": [
    "CVE-2019-11459",
    "CVE-2019-12795"
  ],
  "summary": "Low: GNOME security, bug fix, and enhancement update"
}

CVE-2019-11459 (GCVE-0-2019-11459)

Vulnerability from cvelistv5 – Published: 2019-04-22 20:26 – Updated: 2024-08-04 22:55

Summary

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://gitlab.gnome.org/GNOME/evince/issues/1129	x_refsource_MISC
	https://usn.ubuntu.com/3959-1/	vendor-advisoryx_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
	https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
	https://access.redhat.com/errata/RHSA-2019:3553	vendor-advisoryx_refsource_REDHAT
	https://www.debian.org/security/2020/dsa-4624	vendor-advisoryx_refsource_DEBIAN
	https://seclists.org/bugtraq/2020/Feb/18	mailing-listx_refsource_BUGTRAQ

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:55:40.119Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gitlab.gnome.org/GNOME/evince/issues/1129"
          },
          {
            "name": "USN-3959-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3959-1/"
          },
          {
            "name": "FEDORA-2019-6316c0663e",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LU4YZK5S46TZAH4J3NYYUYFMOC47LJG/"
          },
          {
            "name": "FEDORA-2019-ff2b5b5b47",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ6R7NMY44IHIQIY24CV3WV2GLGJPQPZ/"
          },
          {
            "name": "openSUSE-SU-2019:1667",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.html"
          },
          {
            "name": "[debian-lts-announce] 20190813 [SECURITY] [DLA 1881-1] evince security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html"
          },
          {
            "name": "[debian-lts-announce] 20190813 [SECURITY] [DLA 1882-1] atril security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html"
          },
          {
            "name": "RHSA-2019:3553",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3553"
          },
          {
            "name": "DSA-4624",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4624"
          },
          {
            "name": "20200216 [SECURITY] [DSA 4624-1] evince security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2020/Feb/18"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T06:06:06.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.gnome.org/GNOME/evince/issues/1129"
        },
        {
          "name": "USN-3959-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/3959-1/"
        },
        {
          "name": "FEDORA-2019-6316c0663e",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LU4YZK5S46TZAH4J3NYYUYFMOC47LJG/"
        },
        {
          "name": "FEDORA-2019-ff2b5b5b47",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJ6R7NMY44IHIQIY24CV3WV2GLGJPQPZ/"
        },
        {
          "name": "openSUSE-SU-2019:1667",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.html"
        },
        {
          "name": "[debian-lts-announce] 20190813 [SECURITY] [DLA 1881-1] evince security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html"
        },
        {
          "name": "[debian-lts-announce] 20190813 [SECURITY] [DLA 1882-1] atril security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html"
        },
        {
          "name": "RHSA-2019:3553",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3553"
        },
        {
          "name": "DSA-4624",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4624"
        },
        {
          "name": "20200216 [SECURITY] [DSA 4624-1] evince security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2020/Feb/18"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-11459",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gitlab.gnome.org/GNOME/evince/issues/1129",
              "refsource": "MISC",
              "url": "https://gitlab.gnome.org/GNOME/evince/issues/1129"
            },
            {
              "name": "USN-3959-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/3959-1/"
            },
            {
              "name": "FEDORA-2019-6316c0663e",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7LU4YZK5S46TZAH4J3NYYUYFMOC47LJG/"
            },
            {
              "name": "FEDORA-2019-ff2b5b5b47",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJ6R7NMY44IHIQIY24CV3WV2GLGJPQPZ/"
            },
            {
              "name": "openSUSE-SU-2019:1667",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.html"
            },
            {
              "name": "[debian-lts-announce] 20190813 [SECURITY] [DLA 1881-1] evince security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html"
            },
            {
              "name": "[debian-lts-announce] 20190813 [SECURITY] [DLA 1882-1] atril security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html"
            },
            {
              "name": "RHSA-2019:3553",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3553"
            },
            {
              "name": "DSA-4624",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4624"
            },
            {
              "name": "20200216 [SECURITY] [DSA 4624-1] evince security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2020/Feb/18"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-11459",
    "datePublished": "2019-04-22T20:26:32.000Z",
    "dateReserved": "2019-04-22T00:00:00.000Z",
    "dateUpdated": "2024-08-04T22:55:40.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2019-12795 (GCVE-0-2019-12795)

Vulnerability from cvelistv5 – Published: 2019-06-11 21:07 – Updated: 2024-08-04 23:32

Summary

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc…	x_refsource_MISC
	https://gitlab.gnome.org/GNOME/gvfs/commit/d8c913…	x_refsource_MISC
	https://gitlab.gnome.org/GNOME/gvfs/commit/e3808a…	x_refsource_MISC
	http://www.securityfocus.com/bid/108741	vdb-entryx_refsource_BID
	https://lists.debian.org/debian-lts-announce/2019…	mailing-listx_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
	https://usn.ubuntu.com/4053-1/	vendor-advisoryx_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
	https://access.redhat.com/errata/RHSA-2019:3553	vendor-advisoryx_refsource_REDHAT

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:32:54.828Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/e3808a1b4042761055b1d975333a8243d67b8bfe"
          },
          {
            "name": "108741",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/108741"
          },
          {
            "name": "[debian-lts-announce] 20190619 [SECURITY] [DLA 1827-1] gvfs security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00014.html"
          },
          {
            "name": "openSUSE-SU-2019:1699",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html"
          },
          {
            "name": "openSUSE-SU-2019:1697",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html"
          },
          {
            "name": "USN-4053-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4053-1/"
          },
          {
            "name": "FEDORA-2019-6ed5523cc0",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2/"
          },
          {
            "name": "FEDORA-2019-e6b02af8b8",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ/"
          },
          {
            "name": "RHSA-2019:3553",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2019:3553"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-06T00:08:24.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/e3808a1b4042761055b1d975333a8243d67b8bfe"
        },
        {
          "name": "108741",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/108741"
        },
        {
          "name": "[debian-lts-announce] 20190619 [SECURITY] [DLA 1827-1] gvfs security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00014.html"
        },
        {
          "name": "openSUSE-SU-2019:1699",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html"
        },
        {
          "name": "openSUSE-SU-2019:1697",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html"
        },
        {
          "name": "USN-4053-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4053-1/"
        },
        {
          "name": "FEDORA-2019-6ed5523cc0",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2/"
        },
        {
          "name": "FEDORA-2019-e6b02af8b8",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ/"
        },
        {
          "name": "RHSA-2019:3553",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2019:3553"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2019-12795",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a",
              "refsource": "MISC",
              "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a"
            },
            {
              "name": "https://gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f",
              "refsource": "MISC",
              "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/d8c9138bf240975848b1c54db648ec4cd516a48f"
            },
            {
              "name": "https://gitlab.gnome.org/GNOME/gvfs/commit/e3808a1b4042761055b1d975333a8243d67b8bfe",
              "refsource": "MISC",
              "url": "https://gitlab.gnome.org/GNOME/gvfs/commit/e3808a1b4042761055b1d975333a8243d67b8bfe"
            },
            {
              "name": "108741",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/108741"
            },
            {
              "name": "[debian-lts-announce] 20190619 [SECURITY] [DLA 1827-1] gvfs security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00014.html"
            },
            {
              "name": "openSUSE-SU-2019:1699",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html"
            },
            {
              "name": "openSUSE-SU-2019:1697",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html"
            },
            {
              "name": "USN-4053-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4053-1/"
            },
            {
              "name": "FEDORA-2019-6ed5523cc0",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2/"
            },
            {
              "name": "FEDORA-2019-e6b02af8b8",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ/"
            },
            {
              "name": "RHSA-2019:3553",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2019:3553"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2019-12795",
    "datePublished": "2019-06-11T21:07:32.000Z",
    "dateReserved": "2019-06-11T00:00:00.000Z",
    "dateUpdated": "2024-08-04T23:32:54.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

alsa-2019:3553

Vulnerability from osv_almalinux

CVE-2019-11459 (GCVE-0-2019-11459)

CVE-2019-12795 (GCVE-0-2019-12795)

Tags

Sightings

Nomenclature