Red Hat Enterprise Linux 8 update for GNOME

1) Access of Uninitialized Pointer

EUVDB-ID: #VU29244

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11459

CWE-ID: CWE-824 - Access of Uninitialized Pointer

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due tothe TIFFReadRGBAImageOriented() function called from tiff_document_render() and tiff_document_get_thumbnail() functions in the backend/tiff/tiff-document.c in GNOME Evince returns uninitialized memory instead of false, when failing to read an image. A remote attacker can gain access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for IBM z Systems: 8.0

Red Hat CodeReady Linux Builder for ARM 64: 8.0

Red Hat CodeReady Linux Builder for Power, little endian: 8.0

Red Hat CodeReady Linux Builder for x86_64: 8.0

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

webkit2gtk3 (Red Hat package): before 2.24.3-1.el8

wayland-protocols (Red Hat package): before 1.17-1.el8

plymouth (Red Hat package): before 0.9.3-15.el8

pidgin (Red Hat package): before 2.13.0-5.el8

pango (Red Hat package): before 1.42.4-6.el8

nautilus (Red Hat package): before 3.28.1-10.el8

mutter (Red Hat package): before 3.32.2-10.el8

mozjs60 (Red Hat package): before 60.9.0-3.el8

gvfs (Red Hat package): before 1.36.2-6.el8

gtk3 (Red Hat package): before 3.22.30-4.el8

gsettings-desktop-schemas (Red Hat package): before 3.32.0-3.el8

gnome-tweaks (Red Hat package): before 3.28.1-6.el8

gnome-software (Red Hat package): before 3.30.6-2.el8

gnome-shell-extensions (Red Hat package): before 3.32.1-10.el8

gnome-shell (Red Hat package): before 3.32.2-9.el8

gnome-settings-daemon (Red Hat package): before 3.32.0-4.el8

gnome-remote-desktop (Red Hat package): before 0.1.6-5.el8

gnome-desktop3 (Red Hat package): before 3.32.2-1.el8

gnome-control-center (Red Hat package): before 3.28.2-5.el8

gjs (Red Hat package): before 1.56.2-3.el8

gdm (Red Hat package): before 3.28.3-22.el8

gdk-pixbuf2 (Red Hat package): before 2.36.12-5.el8

file-roller (Red Hat package): before 3.28.1-2.el8

evince (Red Hat package): before 3.28.4-3.el8

chrome-gnome-shell (Red Hat package): before 10.1-6.el8

baobab (Red Hat package): before 3.28.0-2.el8

appstream-data (Red Hat package): before 8-20190805.el8

accountsservice (Red Hat package): before 0.6.50-7.el8

SDL (Red Hat package): before 1.2.15-35.el8

External links

http://access.redhat.com/errata/RHSA-2019:3553

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18791

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12795

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to escalate privileges on the system.

The vulnerability exists due to the daemon/gvfsdaemon.c opened a private D-Bus server socket without configuring an authorization rule. A local attacker can connect to this server socket and issue D-Bus method calls. 

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat CodeReady Linux Builder for IBM z Systems: 8.0

Red Hat CodeReady Linux Builder for ARM 64: 8.0

Red Hat CodeReady Linux Builder for Power, little endian: 8.0

Red Hat CodeReady Linux Builder for x86_64: 8.0

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

webkit2gtk3 (Red Hat package): before 2.24.3-1.el8

wayland-protocols (Red Hat package): before 1.17-1.el8

plymouth (Red Hat package): before 0.9.3-15.el8

pidgin (Red Hat package): before 2.13.0-5.el8

pango (Red Hat package): before 1.42.4-6.el8

nautilus (Red Hat package): before 3.28.1-10.el8

mutter (Red Hat package): before 3.32.2-10.el8

mozjs60 (Red Hat package): before 60.9.0-3.el8

gvfs (Red Hat package): before 1.36.2-6.el8

gtk3 (Red Hat package): before 3.22.30-4.el8

gsettings-desktop-schemas (Red Hat package): before 3.32.0-3.el8

gnome-tweaks (Red Hat package): before 3.28.1-6.el8

gnome-software (Red Hat package): before 3.30.6-2.el8

gnome-shell-extensions (Red Hat package): before 3.32.1-10.el8

gnome-shell (Red Hat package): before 3.32.2-9.el8

gnome-settings-daemon (Red Hat package): before 3.32.0-4.el8

gnome-remote-desktop (Red Hat package): before 0.1.6-5.el8

gnome-desktop3 (Red Hat package): before 3.32.2-1.el8

gnome-control-center (Red Hat package): before 3.28.2-5.el8

gjs (Red Hat package): before 1.56.2-3.el8

gdm (Red Hat package): before 3.28.3-22.el8

gdk-pixbuf2 (Red Hat package): before 2.36.12-5.el8

file-roller (Red Hat package): before 3.28.1-2.el8

evince (Red Hat package): before 3.28.4-3.el8

chrome-gnome-shell (Red Hat package): before 10.1-6.el8

baobab (Red Hat package): before 3.28.0-2.el8

appstream-data (Red Hat package): before 8-20190805.el8

accountsservice (Red Hat package): before 0.6.50-7.el8

SDL (Red Hat package): before 1.2.15-35.el8

External links

http://access.redhat.com/errata/RHSA-2019:3553

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.