12 results · Feed
-
High 7.0
Gvfs: gvfs-admin socket ownership race permits local root
A flaw was found in the admin backend of gvfs. The privileged gvfsd-admin daemon changes the ownership of newly created private D-Bus sockets by calling the link-following chown() function on a pathname inside a user-controlled directory. A local attacker can…
-
Medium 4.3
Gvfs: mtp: out-of-bounds read in do_read()
A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, do_read() in gvfsbackendmtp.c trusts the data length returned by the device without limiting it to the original size requested by the client. If a malicious MTP device…
-
Medium 6.5
Gvfs: afp: heap-based buffer overflow in dsi read path
A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the pre-s…
-
Medium 4.3
Gvfs: sftp: uninitialized heap disclosure in read_string()
A flaw was found in the SFTP backend in gvfs. When mounting a share, a malicious SFTP server can cause read_string() to allocate a buffer with a certain length but the function does not verify that the buffer is completely filled, leaving the remainder of the…
-
High 8.8
Gvfs: sftp: heap-based buffer overflow in read_reply()
A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause read_reply() to process a length that exceeds the size requested by the client. The function does not verify the server-provided length a…
-
Medium 4.3
Gvfs: gvfs ftp backend: information disclosure via untrusted pasv responses
A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to th…
-
Medium 4.3
Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths
A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker t…
-
Unscored —
daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a pri…
-
Unscored —
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and gro…
-
Unscored —
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the …
-
Unscored —
An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership becaus…
-
High 7.0
An incorrect permission check in the admin backend in gvfs before version 1.39.4 was found that allows reading and modi…