[From nobody Fri Sep 11 21:23:16 2026
Received: (at submit) by bugs.debian.org; 2 Sep 2026 09:27:42 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-9.9 required=4.0 tests=BAYES_00, FOURLA,
 FROMDEVELOPER, 
 NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 38; hammy, 150; neutral, 104; spammy,
 0. spammytokens: hammytokens:0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--H*F:U*carnil, 0.000-+--H*Ad:N*Bug,
 0.000-+--HTo:N*Debian
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1x1hFt-00EKMg-18
 for submit@bugs.debian.org; Wed, 02 Sep 2026 09:27:42 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: gvfs: CVE-2026-84267 CVE-2026-84268 CVE-2026-84269 CVE-2026-84270
Message-ID: <178834126044.917067.9015827501939248333.reportbug@elende.valinor.li>
X-Mailer: reportbug 13.2.0+nmu1
Date: Wed, 02 Sep 2026 11:27:40 +0200
Delivered-To: submit@bugs.debian.org

Source: gvfs
Version: 1.60.0-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerabilities were published for gvfs.

CVE-2026-84267[0]:
| A flaw was found in the SFTP backend in gvfs. When mounting a share,
| a malicious SFTP server can cause read_string() to allocate a buffer
| with a certain length but the function does not verify that the
| buffer is completely filled, leaving the remainder of the buffer
| containing uninitialized heap contents. If the server sends a short
| FXP_HANDLE reply, these uninitialized bytes are taken as the file
| handle. The client will then echo these uninitialized bytes back to
| the server on all subsequent requests using that handle. With a
| length of 128 bytes, this issue allows the malicious server to
| deterministically read uninitialized heap memory from the gvfsd-sftp
| process, leaking its heap base and the load address of the libgio
| library, resulting in a deterministic defeat of Address Space Layout
| Randomization (ASLR).


CVE-2026-84268[1]:
| A flaw was found in the SFTP backend in gvfs. When mounting a share
| and reading a file, a malicious SFTP server can cause read_reply()
| to process a length that exceeds the size requested by the client.
| The function does not verify the server-provided length against the
| allocated buffer size, causing the operation to write past the
| intended boundaries. This issue allows a malicious server to corrupt
| adjacent heap memory in the gvfsd-sftp process, resulting in a
| denial of service as the process aborts upon detecting the heap
| corruption or potentially allowing arbitrary code execution.


CVE-2026-84269[2]:
| A flaw was found in the AFP backend in gvfs. When mounting a share,
| a malicious AFP server can cause the DSI read path to process a
| length that exceeds the size requested by the client. The function
| does not verify the server-provided length against the pre-sized
| reply buffer, causing the operation to access past the intended
| boundaries. This issue allows a malicious server to overflow a heap
| buffer and crash the gvfsd-afp process, resulting in a denial of
| service.


CVE-2026-84270[3]:
| A flaw was found in the MTP backend in gvfs. When reading a file
| from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the
| data length returned by the device without limiting it to the
| original size requested by the client. If a malicious MTP device
| responds with more bytes than requested, this unrestricted length is
| passed directly to memcpy(). This causes the operation to read
| memory outside the intended boundaries. This allows an attacker who
| plugs in a malicious MTP device to cause a segmentation fault when a
| file is read and crash the gvfsd-mtp process, resulting in a denial
| of service.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-84267
    https://www.cve.org/CVERecord?id=CVE-2026-84267
[1] https://security-tracker.debian.org/tracker/CVE-2026-84268
    https://www.cve.org/CVERecord?id=CVE-2026-84268
[2] https://security-tracker.debian.org/tracker/CVE-2026-84269
    https://www.cve.org/CVERecord?id=CVE-2026-84269
[3] https://security-tracker.debian.org/tracker/CVE-2026-84270
    https://www.cve.org/CVERecord?id=CVE-2026-84270

Regards,
Salvatore
]