This update for gvfs fixes the following issues :

Security issues fixed :

CVE-2019-12795: Fixed a vulnerability which could have allowed attacks via local D-Bus method calls (bsc#1137930).

CVE-2019-12447: Fixed an improper handling of file ownership in daemon/gvfsbackendadmin.c due to no use of setfsuid (bsc#1136986).

CVE-2019-12449: Fixed an improper handling of file's user and group ownership in daemon/gvfsbackendadmin.c (bsc#1136992).

CVE-2019-12448: Fixed race conditions in daemon/gvfsbackendadmin.c due to implementation of query_info_on_read/write at admin backend (bsc#1136981).

Other issue addressed: Drop polkit rules files that are only relevant for wheel group (bsc#1125433).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

SUSE SLED15 / SLES15 Security Update : gvfs (SUSE-SU-2019:1717-1)

critical Nessus Plugin ID 126444

Version 1.8

Version 1.7

Version 1.8 Feb 18, 2025, 11:54 PM Plugin metadata (CVSS 3 Change AC:H --> AC:L where needed) Plugin Feed: 202502182354
Version 1.7 May 13, 2024, 8:02 AM CVSSv2 score source (set to "CVE-2019-12448") Exploit attributes ("Exploit available" set to "False") Plugin Feed: 202405130802