CVE-2019-12795

Publication date 11 June 2019

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gvfs	19.04 disco	Fixed in 1.40.1-1ubuntu0.1
	18.10 cosmic	Fixed in 1.38.1-0ubuntu1.3.2
	18.04 LTS bionic	Fixed in 1.36.1-0ubuntu1.3.3
	16.04 LTS xenial	Fixed in 1.28.2-1ubuntu1~16.04.3
	14.04 LTS trusty	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
gvfs	Upstream: 70dbfc6 Upstream: d8c9138 Upstream: a0da5f1 Upstream: e3808a1 Upstream: 756edf6

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.8 · High

Base metrics

Parameter	Value
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High

Scores

Parameter	Value
Base score	7.8 · High
Exploitability score	-
Impact score	-

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

USN-4053-1
GVfs vulnerabilities
9 July 2019

Other references

https://www.cve.org/CVERecord?id=CVE-2019-12795