[From nobody Fri Sep 11 16:25:07 2026
Received: (at 1147399-done) by bugs.debian.org; 11 Sep 2026 15:23:48 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-111.2 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,
 FROMDEVELOPER,HAS_BUG_NUMBER,SPF_HELO_NONE,SPF_PASS,
 USER_IN_DKIM_WELCOMELIST,VERSION autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 15; hammy, 110; neutral, 14; spammy,
 0. spammytokens:
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <smcv@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:40594)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <smcv@debian.org>) id 1x536S-006uqW-2i
 for 1147399-done@bugs.debian.org; Fri, 11 Sep 2026 15:23:48 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:In-Reply-To:Content-Type:MIME-Version:
 References:Message-ID:Subject:To:From:Date:Reply-To:Cc:
 Content-Transfer-Encoding:Content-ID:Content-Description;
 bh=J/uwAzd/JGEVRO3b/K/suASXYUvA3mRDS03uT8i8I+E=; b=b3RC2lKJ2GTUoK9P6i3sJ+2se7
 jqAa2fP/Xg1KRVc7EmQ+e2dVA5O0FDQr7kX4mA49JsnVZKRLne9wt8juWeCTN33Pn0xapcTPsM4YS
 ePi9a7r8YKeZ8+XnQJfHikhTjMrRFjUmd8/WKSvvkPlpb9zXV+u/dFS1e/mh1ciwue+vmNF6obuoM
 SgrtKZjjD+AItKhyEbWuRvZT6eTPc1vla6cFAhG65RWo6dm+qUWwbL3vtUY1KsaZcsFZZAck9gLub
 TAuBn4QooBTUW+xI/h+K7Pa3xY2EtyEtTIga1L2LybPoUh2sPam/w7zz2phu9Vd7mn+xGxzDVJcj/
 /wgw1Kyw==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <smcv@debian.org>) id 1x536Q-001Nh0-1f;
 Fri, 11 Sep 2026 15:23:47 +0000
Date: Fri, 11 Sep 2026 16:23:44 +0100
From: Simon McVittie <smcv@debian.org>
To: Salvatore Bonaccorso <carnil@debian.org>, 1147399-done@bugs.debian.org
Subject: Re: Bug#1147399: gvfs: CVE-2026-88924
Message-ID: <aqQdANRDTC1C8cMw@definition.pseudorandom.co.uk>
References: <178913838860.2615311.15622813428221618780.reportbug@eldamar.lan>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <178913838860.2615311.15622813428221618780.reportbug@eldamar.lan>
X-Debian-User: smcv

Version: 1.62.0-1

On Fri, 11 Sep 2026 at 16:53:08 +0200, Salvatore Bonaccorso wrote:
>CVE-2026-88924[0]:
>[0] https://security-tracker.debian.org/tracker/CVE-2026-88924
>    https://www.cve.org/CVERecord?id=CVE-2026-88924
>[1] https://gitlab.gnome.org/GNOME/gvfs/-/issues/875
>[2] https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/352

Looks like Jeremy uploaded the new release already.]