CVE-2019-12450: canonical ubuntu_linux Incorrect Default Permissions
CVSS: 9.8v3.1CriticalModified
AliasesALPINE-CVE-2019-12450MGASA-2019-0352SUSE-SU-2019:14102-1SUSE-SU-2019:1594-1RHSA-2019:3530UBUNTU-CVE-2019-12450USN-4014-1USN-4014-2DEBIAN-CVE-2019-12450DLA-1826-1openSUSE-SU-2019:1650-1
Published 29-05-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-12450 is a critical (CVSS 9.8) Incorrect Default Permissions vulnerability in canonical ubuntu_linux. EPSS estimates a 2.62% chance of exploitation in the next 30 days, higher than 85.2% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
2.62%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 29-05-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.
CVSS metrics
7 scores · 5 sources · 3 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 6.6Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:NSources2 sources · 6.6–9.8
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
High 7.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.62%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
+0.02 pp
From 2.60% on 19-09-2026
19-09-202619-10-2026
EPSS score2.62%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-276Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
Redhat15 products
- enterprise_linux8.0
- enterprise_linux_eus8.1 | 8.2 | 8.4 | 8.6
- enterprise_linux_server_aus8.2 | 8.4 | 8.6
- enterprise_linux_server_tus8.2 | 8.4 | 8.6
- glib2< 0:2.56.4-7.el8
Suse5 products
- glib2&distro=SUSE Linux Enterprise Module for Basesystem 15< 2.54.3-4.15.1
- glib2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 2.54.3-4.15.1
- glib2&distro=SUSE Linux Enterprise Module for Package Hub 15< 2.54.3-4.15.1
- glib2&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 2.22.5-0.8.39.1
- glib2&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 2.22.5-0.8.39.1
Debian2 products
- glib2.0< 2.58.3-2 | < 2.42.1-1+deb8u1
- debian_linuxEOL8.0
Opensuse2 products
- leapEOL15.0
- glib2&distro=openSUSE Leap 15.0< 2.54.3-lp150.3.10.1
Alpine1 product
- glib≥ 2.15.0, < 2.60.4-r0 | ≥ 2.15.0, < 2.54.2-r1 | ≥ 2.15.0, < 2.56.1-r1 | ≥ 2.15.0, < 2.58.1-r3
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 18.10 | 19.04
Fedoraproject1 product
- fedoraEOL30
Gnome1 product
- glib≥ 2.15.0, ≤ 2.61.1
Mageia1 product
- glib2.0< 2.60.2-1.2.mga7
Ubuntu1 product
- glib2.0< 2.48.2-0ubuntu4.2 | < 2.56.4-0ubuntu0.18.04.3 | < 2.40.2-0ubuntu1.1+esm1
10 vendors · 30 products
References
32 links- gitlab.gnome.org/GNOME/glib/commit/d8f8f4d637ce43f8699ba94c9b7648beda0ca174X Refsource MISCPatchVendor Advisory
lists.debian.org/debian-lts-announce/2019/06/msg00013.htmlMailing ListX Refsource MLISTThird Party Advisory- lists.opensuse.org/opensuse-security-announce/2019-06/msg00076.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- access.redhat.com/errata/RHSA-2019:3530Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
Show all 32 references
- lists.opensuse.org/archives/…Advisory