Package "gvfs"
| Name: |
gvfs
|
Description: |
userspace virtual filesystem - GIO module
|
| Latest version: |
1.54.4-0ubuntu1~24.04.5 |
| Release: |
noble (24.04) |
| Level: |
security |
| Repository: |
main |
| Homepage: |
https://wiki.gnome.org/Projects/gvfs |
Links
Download "gvfs"
Other versions of "gvfs" in Noble
Packages in group
Deleted packages are displayed in grey.
Changelog
|
gvfs (1.54.4-0ubuntu1~24.04.5) noble-security; urgency=medium
* SECURITY UPDATE: ASLR bypass in SFTP backend
- debian/patches/CVE-2026-84267.patch: sftp: Validate that reads fully
complete before using data in daemon/gvfsbackendsftp.c.
- CVE-2026-84267
* SECURITY UPDATE: DoS in AFP backend
- debian/patches/CVE-2026-84269.patch: afp: Validate reply size in DSI read
reply handling in daemon/gvfsafpconnection.c, daemon/gvfsafpconnection.h,
daemon/gvfsafpserver.c, daemon/gvfsafpvolume.c.
- CVE-2026-84269
* SECURITY UPDATE: DoS in MTP backend
- debian/patches/CVE-2026-84270.patch: mtp: Validate read size returned by
device in daemon/gvfsbackendmtp.c.
- CVE-2026-84270
-- Marc Deslauriers Mon, 05 Oct 2026 12:44:14 -0400
|
| Source diff to previous version |
| CVE-2026-84267 |
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a cert |
| CVE-2026-84269 |
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that excee |
| CVE-2026-84270 |
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length retu |
|
|
gvfs (1.54.4-0ubuntu1~24.04.4) noble-security; urgency=medium
* SECURITY UPDATE: Heap buffer overflow in SFTP backend during file read
- debian/patches/CVE-2026-84268_1.patch: Clamp `read_reply` count to
requested buffer size in daemon/gvfsbackendsftp.c.
- debian/patches/CVE-2026-84268_2.patch: Return error when server sends
more data than requested in daemon/gvfsbackendsftp.c.
- CVE-2026-84268
* SECURITY UPDATE: Privilege escalation via TOCTOU race in admin backend
- debian/patches/CVE-2026-88924.patch: Set socket ownership before
creation in daemon/gvfsdaemon.c.
- CVE-2026-88924
-- Shafayat Hossain Majumder Fri, 25 Sep 2026 13:39:17 -0400
|
| Source diff to previous version |
| CVE-2026-84268 |
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a l |
| CVE-2026-88924 |
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by call |
|
|
gvfs (1.54.4-0ubuntu1~24.04.2) noble-security; urgency=medium
* SECURITY UPDATE: open port probe via FTP backend
- debian/patches/CVE-2026-28295.patch: use control connection address
for PASV data in daemon/gvfsbackendftp.c, daemon/gvfsbackendftp.h,
daemon/gvfsftptask.c.
- CVE-2026-28295
* SECURITY UPDATE: arbitrary FTP command injection via CRLF
- debian/patches/CVE-2026-28296.patch: reject paths containing CR/LF
characters in daemon/gvfsbackendftp.c, daemon/gvfsftpfile.c,
daemon/gvfsftpfile.h.
- CVE-2026-28296
-- Marc Deslauriers <email address hidden> Wed, 18 Mar 2026 12:12:50 -0400
|
| CVE-2026-28295 |
A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its |
| CVE-2026-28296 |
A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file pat |
|
About
-
Send Feedback to @ubuntu_updates
