Summary
It was discovered that GVfs did not properly validate data returned by
an SFTP server. A remote attacker could possibly use this issue to
obtain sensitive information.
(CVE-2026-84267)
It was discovered that GVfs did not properly validate the size of
replies from an AFP server. A remote attacker could possibly use this
issue to cause a denial of service.
(CVE-2026-84269)
It was discovered that GVfs did not properly validate the size of data
returned by an MTP device. An attacker with a malicious MTP device
could possibly use this issue to cause a denial of service.
(CVE-2026-84270)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | gvfs | 1.48.2-0ubuntu1.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | gvfs | 1.54.4-0ubuntu1~24.04.5 |
| Ubuntu · 26.04 LTS 26.04:LTS | gvfs | 1.60.0-1ubuntu0.2 |