Your message dated Fri, 11 Sep 2026 22:20:33 +0200
with message-id
<CAAajCMYcuJtYd=ZHC6uO=2d3euaq0ichwvml5f0vzrnmzsd...@mail.gmail.com>
and subject line Re: Bug#1146478: gvfs: CVE-2026-84267 CVE-2026-84268
CVE-2026-84269 CVE-2026-84270
has caused the Debian Bug report #1146478,
regarding gvfs: CVE-2026-84267 CVE-2026-84268 CVE-2026-84269 CVE-2026-84270
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146478: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146478
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: gvfs
Version: 1.60.0-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for gvfs.
CVE-2026-84267[0]:
| A flaw was found in the SFTP backend in gvfs. When mounting a share,
| a malicious SFTP server can cause read_string() to allocate a buffer
| with a certain length but the function does not verify that the
| buffer is completely filled, leaving the remainder of the buffer
| containing uninitialized heap contents. If the server sends a short
| FXP_HANDLE reply, these uninitialized bytes are taken as the file
| handle. The client will then echo these uninitialized bytes back to
| the server on all subsequent requests using that handle. With a
| length of 128 bytes, this issue allows the malicious server to
| deterministically read uninitialized heap memory from the gvfsd-sftp
| process, leaking its heap base and the load address of the libgio
| library, resulting in a deterministic defeat of Address Space Layout
| Randomization (ASLR).
CVE-2026-84268[1]:
| A flaw was found in the SFTP backend in gvfs. When mounting a share
| and reading a file, a malicious SFTP server can cause read_reply()
| to process a length that exceeds the size requested by the client.
| The function does not verify the server-provided length against the
| allocated buffer size, causing the operation to write past the
| intended boundaries. This issue allows a malicious server to corrupt
| adjacent heap memory in the gvfsd-sftp process, resulting in a
| denial of service as the process aborts upon detecting the heap
| corruption or potentially allowing arbitrary code execution.
CVE-2026-84269[2]:
| A flaw was found in the AFP backend in gvfs. When mounting a share,
| a malicious AFP server can cause the DSI read path to process a
| length that exceeds the size requested by the client. The function
| does not verify the server-provided length against the pre-sized
| reply buffer, causing the operation to access past the intended
| boundaries. This issue allows a malicious server to overflow a heap
| buffer and crash the gvfsd-afp process, resulting in a denial of
| service.
CVE-2026-84270[3]:
| A flaw was found in the MTP backend in gvfs. When reading a file
| from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the
| data length returned by the device without limiting it to the
| original size requested by the client. If a malicious MTP device
| responds with more bytes than requested, this unrestricted length is
| passed directly to memcpy(). This causes the operation to read
| memory outside the intended boundaries. This allows an attacker who
| plugs in a malicious MTP device to cause a segmentation fault when a
| file is read and crash the gvfsd-mtp process, resulting in a denial
| of service.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-84267
https://www.cve.org/CVERecord?id=CVE-2026-84267
[1] https://security-tracker.debian.org/tracker/CVE-2026-84268
https://www.cve.org/CVERecord?id=CVE-2026-84268
[2] https://security-tracker.debian.org/tracker/CVE-2026-84269
https://www.cve.org/CVERecord?id=CVE-2026-84269
[3] https://security-tracker.debian.org/tracker/CVE-2026-84270
https://www.cve.org/CVERecord?id=CVE-2026-84270
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Version: 1.62.0-1
It looks like all 3 of these were fixed in 1.62.0 although only
https://security-tracker.debian.org/tracker/CVE-2026-88924 was
mentioned in the upstream NEWS.
Additionally, CVE-2026-84269 is further mitigated because afp is a
"deprecated" backend and we no longer build deprecated backends as of
this Debian version.
Thank you,
Jeremy Bícha
--- End Message ---
