Skip to content
This repository has been archived by the owner on Apr 12, 2021. It is now read-only.
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixpkgs-channels
base: d6da20c19493
Choose a base ref
...
head repository: NixOS/nixpkgs-channels
compare: be7c1a3e6b77
Choose a head ref
  • 3 commits
  • 1 file changed
  • 1 contributor

Commits on Jun 18, 2019

  1. gvfs: fix CVE-2019-1244{7.8.9} 

    CVE-2019-12447:
daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is
not used.

CVE-2019-12448:
daemon/gvfsbackendadmin.c has race conditions because the admin backend
doesn't implement query_info_on_read/write.

CVE-2019-12449:
daemon/gvfsbackendadmin.c mishandles a file's user and group ownership
during move (and copy with G_FILE_COPY_ALL_METADATA) operations
from admin:// to file:// URIs, because root privileges are unavailable.

Upstream MR: https://gitlab.gnome.org/GNOME/gvfs/merge_requests/48
Closes #63067
    @worldofpeace
    worldofpeace committed Jun 18, 2019
    Copy the full SHA
    d2bfd7a View commit details
    Browse the repository at this point in the history

  2. gvfs: fix CVE-2019-12795 

    Vulnerability Description:
daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before
1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without
configuring an authorization rule. A local attacker could connect to this server
socket and issue D-Bus method calls. Note that the server socket only accepts
a single connection, so the attacker would have to discover the server and connect
to the socket before its owner does.

Closes #63301
    @worldofpeace
    worldofpeace committed Jun 18, 2019
    Copy the full SHA
    6ac7c77 View commit details
    Browse the repository at this point in the history

Commits on Jun 19, 2019

  1. Merge pull request #63481 from worldofpeace/gvfs/security-fixes 

    [19.03] gvfs: security fixes
    @worldofpeace
    worldofpeace committed Jun 19, 2019
    Copy the full SHA
    be7c1a3 View commit details
    Browse the repository at this point in the history