CVE-2019-3827

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modify arbitrary files by privileged users without asking for password when no authentication agent is running. This vulnerability can be exploited by malicious programs running under privileges of users belonging to the wheel group to further escalate its privileges by modifying system files without user's knowledge. Successful exploitation requires uncommon system configuration.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
[UNKNOWN]	gvfs	1.39.4

References

https://access.redhat.com/errata/RHSA-2019:1517Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2145Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3827Issue Tracking, Patch, Third Party Advisory
https://gitlab.gnome.org/GNOME/gvfs/merge_requests/31Patch, Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:1517Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2145Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3827Issue Tracking, Patch, Third Party Advisory
https://gitlab.gnome.org/GNOME/gvfs/merge_requests/31Patch, Vendor Advisory

Timeline

Published: Mar 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38284.2Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files out CVE-2019-38297.5A vulnerability was found in gnutls versions from 3.5.8 before 3.6.7. A memory corruption (double free) vulnerability in the certificate ver CVE-2019-38307.8A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configurati CVE-2019-38316.7A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm CVE-2019-38325.5It was discovered the fix for CVE-2018-19758 (libsndfile) was not complete and still allows a read beyond the limits of a buffer in wav_writ CVE-2019-38337.5Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP r CVE-2019-38347.3It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate CVE-2019-38355.5It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27. A specially crafted PostScript CVE-2019-38367.5It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer access in gnutls versions 3.6.3 or later wh CVE-2019-38376.1It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-thre CVE-2019-38385.5It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27. A specially crafted Po CVE-2019-38397.8It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially