High severity · published May 29, 2019
CVE-2019-12448
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2
8.1
CVSS
1.8%
EPSS
No
On KEV
Description
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GV
Gvfs · Gnome
1.29.4 through 1.41.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12448
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12448
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00008.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00009.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2019/07/09/3
gitlab.gnome.org
https://gitlab.gnome.org/GNOME/gvfs/commit/764e9af7522e3096c0f44613c330377d31c9bbb5
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP6BFQUPQRVRRFIYHFWWB6RHJNEB4LGQ/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M2DQVOL5H5BVLXYCEB763DCIYJQ7ZUQ2/
More from Gvfs
8.8
CVE-2026-84268
Gvfs: sftp: heap-based buffer overflow in read_reply()
7.8
CVE-2019-12795
daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an…
7.3
CVE-2019-12447
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2
7.0
CVE-2026-88924
Gvfs: gvfs-admin socket ownership race permits local root
7.0
CVE-2019-3827
An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for…