CVE-2019-12450
9.8
CRITICAL · CVSS 3.1 · EPSS 2.6% (pctl 85)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.62% — more likely to be exploited than 85% of all CVEs |
| Weakness | CWE-276 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-05-29 |
| Last modified | 2026-06-17 |
Affected (9)
| Vendor | Product |
|---|---|
| canonical | ubuntu linux |
| debian | debian linux |
| fedoraproject | fedora |
| gnome | glib |
| opensuse | leap |
| redhat | enterprise linux |
| redhat | enterprise linux eus |
| redhat | enterprise linux server aus |
| redhat | enterprise linux server tus |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.html
- https://access.redhat.com/errata/RHSA-2019:3530
- https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174
- https://lists.debian.org/debian-lts-announce/2019/06/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/
- https://security.netapp.com/advisory/ntap-20190606-0003/
- https://usn.ubuntu.com/4014-1/
- https://usn.ubuntu.com/4014-2/
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.html
- https://access.redhat.com/errata/RHSA-2019:3530
- https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174
- https://lists.debian.org/debian-lts-announce/2019/06/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/
- https://security.netapp.com/advisory/ntap-20190606-0003/
- https://usn.ubuntu.com/4014-1/
- https://usn.ubuntu.com/4014-2/
→ the Explorer · watch your stack · NVD