CVE-2019-12450

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276 CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.htmlThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:3530Third Party Advisory
https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00013.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/
https://security.netapp.com/advisory/ntap-20190606-0003/Third Party Advisory
https://usn.ubuntu.com/4014-1/Third Party Advisory
https://usn.ubuntu.com/4014-2/Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.htmlThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:3530Third Party Advisory
https://gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2019/06/msg00013.htmlMailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2W4WIOAGO3M743M5KZLVQZM3NGHQDYLI/
https://security.netapp.com/advisory/ntap-20190606-0003/Third Party Advisory
https://usn.ubuntu.com/4014-1/Third Party Advisory
https://usn.ubuntu.com/4014-2/Third Party Advisory

Timeline

Published: May 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-124527.5types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without CVE-2019-124536.1In MicroStrategy Web before 10.1 patch 10, stored XSS is possible in the FLTB parameter due to missing input validation.CVE-2019-124547.8An issue was discovered in wcd9335_codec_enable_dec in sound/soc/codecs/wcd9335.c in the Linux kernel through 5.1.5. It uses kstrndup instea CVE-2019-124555.5An issue was discovered in sunxi_divs_clk_setup in drivers/clk/sunxi/clk-sunxi.c in the Linux kernel through 5.1.5. There is an unchecked ks CVE-2019-124567.8An issue was discovered in the MPT3COMMAND case in _ctl_ioctl_main in drivers/scsi/mpt3sas/mpt3sas_ctl.c in the Linux kernel through 5.1.5. CVE-2019-124575.3FileRun 2019.05.21 allows images/extjs Directory Listing. This issue has been fixed in FileRun 2019.06.01.CVE-2019-124585.3FileRun 2019.05.21 allows css/ext-ux Directory Listing. This issue has been fixed in FileRun 2019.06.01.CVE-2019-124595.3FileRun 2019.05.21 allows customizables/plugins/audio_player Directory Listing. This issue has been fixed in FileRun 2019.06.01.CVE-2019-12467.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En CVE-2019-124606.1Web Port 1.19.1 allows XSS via the /access/setup type parameter.CVE-2019-124616.1Web Port 1.19.1 allows XSS via the /log type parameter.CVE-2019-124638.8An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/