Güvenlik Danışarlıklarına Dön

GVfs Vulnerabilities — Ubuntu Security Update (USN-8970-1)

USN-8970-1 fixes three GVfs vulnerabilities on Ubuntu: improper validation of SFTP server responses allowing sensitive-information disclosure (CVE-2026-84267), improper reply-size validation, and a third parsing flaw. Update: sudo apt update && sudo apt upgrade gvfs and restart GVfs-using sessions.

High 4.3 CVSS
Ubuntu 20.04 Ubuntu 22.04

SharedLicense lisansı altında bunun anlamı

GVfs mounts remote file systems (SFTP, SMB) for desktop applications — a malicious or compromised file server can leak memory contents of every client application reading through the mount.

  1. Ubuntu Security Notices

  2. USN-8970-1

Publication date

3 November 2026

Overview

Several security issues were fixed in GVfs.

Releases


26.04 LTS


24.04 LTS


22.04 LTS

Packages

  • gvfs – Userspace virtual file system

Details

It was discovered that GVfs did not properly validate data returned by
an SFTP server. A remote attacker could possibly use this issue to
obtain sensitive information.
(CVE-2026-84267)

It was discovered that GVfs did not properly validate the size of
replies from an AFP server. A remote attacker could possibly use this
issue to cause a denial of service.
(CVE-2026-84269)

It was discovered that GVfs did not properly validate the size of data
returned by an MTP device. An attacker with a malicious MTP device
could possibly use this issue to cause a denial of service.
(CVE-2026-84270)

It was discovered that GVfs did not properly validate data returned by
an SFTP server. A remote attacker could possibly use this issue to
obtain sensitive information.
(CVE-2026-84267)

It was discovered that GVfs did not properly validate the size of
replies from an AFP server. A remote attacker could possibly use this
issue to cause a denial of service.
(CVE-2026-84269)

It was discovered that GVfs did not properly validate the size of data
returned by an MTP device. An attacker with a malicious MTP device
could possibly use this issue to cause a denial of service.
(CVE-2026-84270)

Update instructions

After a standard system update you need to restart your session to make
all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04

LTS resolute

 gvfs – 

1.60.0-1ubuntu0.2
24.04

LTS noble

 gvfs – 

1.54.4-0ubuntu1~24.04.5
22.04

LTS jammy

 gvfs – 

1.48.2-0ubuntu1.3

References

Sıkça Sorulan Sorular

What is USN-8970-1?
It is Ubuntu's GVfs security notice fixing three CVEs: improper validation of SFTP server data allowing sensitive-information disclosure (CVE-2026-84267), improper reply-size validation, and a related parsing flaw — rated 4.3 aggregate.
Who is affected?
Ubuntu desktops and workstations using GVfs mounts (SFTP/SSH file browsing in the file manager) that connect to remote file servers — the server's responses are the attack input.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade gvfs and unmount/remount any active GVfs mounts so the patched library is used.
Is this relevant on servers?
Rarely — GVfs is a desktop virtual-filesystem layer. Headless servers without a desktop session do not run it; the exposure is on workstations connecting to untrusted file servers.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin