MGASA-2019-0214 - Updated gvfs packages fix security vulnerabilities

Publication date: 21 Jul 2019
URL: https://advisories.mageia.org/MGASA-2019-0214.html
Type: security
Affected Mageia releases: 6, 7
CVE: CVE-2019-12447,
     CVE-2019-12448,
     CVE-2019-12449,
     CVE-2019-12795

Updated gvfs package fixes security vulnerabilities:

* daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid
  is not used (CVE-2019-12447).
* daemon/gvfsbackendadmin.c has race conditions because the admin backend
  doesn't implement query_info_on_read/write (CVE-2019-12448).
* daemon/gvfsbackendadmin.c mishandles a file's user and group ownership
  during move (and copy with G_FILE_COPY_ALL_METADATA) operations from
  admin:// to file:// URIs, because root privileges are unavailable
  (CVE-2019-12449).
* daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x
  before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server
  socket without configuring an authorization rule (CVE-2019-12795)

References:
- https://bugs.mageia.org/show_bug.cgi?id=25114
- https://ubuntu.com/security/notices/USN-4053-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12447
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12448
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12449
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12795

SRPMS:
- 7/core/gvfs-1.40.1-4.1.mga7
- 6/core/gvfs-1.32.1-1.2.mga6