Ubuntu alert USN-8845-1 (gvfs)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8845-1] GVfs vulnerabilities | |
| Date: | Wed, 30 Sep 2026 22:20:37 +0000 | |
| Message-ID: | <E1xC2fF-0007pq-5J@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8845-1 September 30, 2026 gvfs vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS Summary: Several security issues were fixed in GVfs. Software Description: - gvfs: Userspace virtual file system Details: Keith Linneman discovered that GVfs did not properly validate data received from SFTP servers. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in arbitrary code execution or a denial of service. (CVE-2026-84268) It was discovered that GVfs incorrectly handled file ownership when creating private D-Bus sockets in the admin backend. A local attacker could possibly use this issue to change the ownership of arbitrary system files, resulting in privilege escalation to root. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-88924) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS gvfs-backends 1.60.0-1ubuntu0.1 gvfs-libs 1.60.0-1ubuntu0.1 Ubuntu 24.04 LTS gvfs-backends 1.54.4-0ubuntu1~24.04.4 gvfs-libs 1.54.4-0ubuntu1~24.04.4 Ubuntu 22.04 LTS gvfs-backends 1.48.2-0ubuntu1.2 gvfs-libs 1.48.2-0ubuntu1.2 Ubuntu 20.04 LTS gvfs-backends 1.44.1-1ubuntu1.2+esm1 Available with Ubuntu Pro gvfs-libs 1.44.1-1ubuntu1.2+esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS gvfs-backends 1.36.1-0ubuntu1.3.3+esm1 Available with Ubuntu Pro gvfs-libs 1.36.1-0ubuntu1.3.3+esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS gvfs-backends 1.28.2-1ubuntu1~16.04.3+esm1 Available with Ubuntu Pro gvfs-libs 1.28.2-1ubuntu1~16.04.3+esm1 Available with Ubuntu Pro After a standard system update you need to restart your session to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8845-1 CVE-2026-84268, CVE-2026-88924 Package Information: https://launchpad.net/ubuntu/+source/gvfs/1.60.0-1ubuntu0.1 https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1... https://launchpad.net/ubuntu/+source/gvfs/1.48.2-0ubuntu1.2
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq9iXwACgkQcpJm3tlz hgGPZhAAxG6cDZiPg1Y6+6fP13f8+F22L7dZwDKCyHApDMkgqXXH6o3KF46aFdUN la/IL9iFHKre9kC5YOGFULxVKnThyP6kz8o3AIZB8htq+GaaDsTpD06FcOZDeI+f vaqZRsLvpeybfRgXzCSub+KN38HrZRez/i/XmIzpw8W7koQ69DbxjfHBdgHopWpI tgmuV4M0MFQYLfcRQR/+FHuLT9BYeYJdjuvWhvI41DEKK6RAoveol+IWYfoC8AoN I1E2RGERlIbirPSM9wLITjb9HBNpMcCqtFSGbqYdwMhCd8PGrk+xb3zoOSAgUW15 HHrVYi4h07ImrdxWXResf2I7MK2xtmEdZCgkiBVSCY1kIUo1K7VPt3Mqv1hzu0IX 0Rw73q4tWpv5TJ2YhPZalH6YkqVSZtdbCO2ZF1VgcAHUk4eaMlLil3NFMcrScGSc 5J9Zmw7H25FjB6UqYcL5BZUE8kt7Xb1BoudhyZSFjHhwNuNhEdo/i5n25GvWDxQD zFjbdMetQGufqUa1s+zxrE8hZ0fAL5UEahSrS3azbvq4P+ZCaVWSVvVvCDZtcLXj zTQkdzRj8KHA4Q+PJho6hAFFA8x3/83Emf46XvBQCA8k6HjUWAYJggB+voIjvEmU 4gNzeEC6Pq7dIDa+fQyT0hIDV4RR+Noh8352AVtp7dGR9TJx0zI= =H72d -----END PGP SIGNATURE-----