[From nobody Fri Sep 11 21:23:16 2026
Received: (at 1146478-done) by bugs.debian.org; 11 Sep 2026 20:21:14 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-111.1 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,
 FOURLA,FROMDEVELOPER,HAS_BUG_NUMBER,SPF_HELO_NONE,SPF_PASS,
 USER_IN_DKIM_WELCOMELIST,VERSION autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 21; hammy, 110; neutral, 20; spammy,
 1. spammytokens:0.888-+--news
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <jbicha@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:50316)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <jbicha@debian.org>) id 1x57kI-007iL7-0K
 for 1146478-done@bugs.debian.org; Fri, 11 Sep 2026 20:21:14 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Content-Transfer-Encoding:Content-Type
 :To:Subject:Message-ID:Date:From:In-Reply-To:References:MIME-Version:Reply-To
 :Cc:Content-ID:Content-Description;
 bh=PjhZ7QGTKK3woX4SSlFjJopgK9yeEWx/mHb1tFPsZB0=; b=M40CTyUR5iDH1CcmSPJmpX0Ppt
 wkqvEyGRe3S5K3M1Euzmew9OaiLd0rcs4ymdoJ0MHin2F/YoGvnDLoUKhmN14lGocTDfCTsMuDqNv
 gXWEe6Hkc95UJWDpevd3fF4wmMC0i2bmC0yV58WmAPu5XOu9GhX2M2Kc9daYrZbE3vR2sAhe0l2sM
 IKXn5Zwd59d/DhQhmfWNx5ct4hm6SCf3LL3Jhkg1bVryazBRXxMW/fOTd9Ero7k41PAR0f4pmK4qq
 n+A2h4CcFI8k5ll7W/2ZzlAqawLGvR5G1CebIT95QY96FQ1Ll3lQE5c2pFhObf11tIMUiuzpslCjH
 l4EpnC4A==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128)
 (Exim 4.96) (envelope-from <jbicha@debian.org>) id 1x57kG-001Xqq-24
 for 1146478-done@bugs.debian.org; Fri, 11 Sep 2026 20:21:12 +0000
Received: by mail-pl1-f180.google.com with SMTP id
 d9443c01a7336-2d91ff7d9acso11993935ad.3
 for <1146478-done@bugs.debian.org>; Fri, 11 Sep 2026 13:21:12 -0700 (PDT)
X-Forwarded-Encrypted: i=1;
 AKwUvBzEUfoz1AjiN6cpBXNxTrii7iBcdNCdWT2wykpBsty/VNnu7vgO+apM9ULoYmshPJI270oUgsxCnUTyXoo=@bugs.debian.org
X-Gm-Message-State: AFuF++lsZOmKwyfHAoR9hFLGM6lyBSQ6Z1r5EN3KD4f3/AQ9sbCaoTQn
 +x0Bal3GKZuXiOxgGpgQnRFiYGz6zTyccAdf0MydnSk6GfCn0uqXpAMPGWKXW6EUjNsskWCWvNG
 dDSnXPqhTt26MPEyfVunmlvRpd06Zf7jahOsWMEiHE5CtTvksPbYwFDoRpqhtggZBXiglJMiztC
 ddsFKNOFoUxCG+tcCfDrsliPSMG0G0IA==
X-Received: by 2002:a17:90b:5605:b0:38f:7f60:ba35 with SMTP id
 98e67ed59e1d1-39d9bbd8837mr8858624a91.5.1789158070265; Fri, 11 Sep 2026
 13:21:10 -0700 (PDT)
MIME-Version: 1.0
References: <178834126044.917067.9015827501939248333.reportbug@elende.valinor.li>
In-Reply-To: <178834126044.917067.9015827501939248333.reportbug@elende.valinor.li>
From: =?UTF-8?Q?Jeremy_B=C3=ADcha?= <jbicha@debian.org>
Date: Fri, 11 Sep 2026 22:20:33 +0200
X-Gmail-Original-Message-ID: <CAAajCMYcuJtYd=ZHC6uO=2D3euAQ0iChWVML5F0VzrNmZsD5PA@mail.gmail.com>
X-Gm-Features: AcwNN1WdkqkxporsiyhDxC6qJajCFVMzZzLYd1qxqvgKSvDIqMIED4XA7RRdt5o
Message-ID: <CAAajCMYcuJtYd=ZHC6uO=2D3euAQ0iChWVML5F0VzrNmZsD5PA@mail.gmail.com>
Subject: Re: Bug#1146478: gvfs: CVE-2026-84267 CVE-2026-84268 CVE-2026-84269
 CVE-2026-84270
To: Salvatore Bonaccorso <carnil@debian.org>, 1146478-done@bugs.debian.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Debian-User: jbicha

Version: 1.62.0-1

It looks like all 3 of these were fixed in 1.62.0 although only
https://security-tracker.debian.org/tracker/CVE-2026-88924 was
mentioned in the upstream NEWS.

Additionally, CVE-2026-84269 is further mitigated because afp is a
"deprecated" backend and we no longer build deprecated backends as of
this Debian version.

Thank you,
Jeremy B=C3=ADcha]