OPENSUSE-SU-2026:20451-1: gnome-online-accounts&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:20451-1 is a vulnerability in gnome-online-accounts&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 31-03-2026
   PublishedVulnerability first disclosed.
2. 03-04-2026
   Last modifiedVulnerability information updated.

Description

Security update for gnome-online-accounts, gvfs This update for gnome-online-accounts, gvfs fixes the following issues: Changes for gvfs: Update gvfs to 1.59.90: - CVE-2026-28295: information disclosure when processing untrusted PASV responses from FTP servers (bsc#1258953). - CVE-2026-28296: arbitrary FTP command injection due to unsanitized CRLF sequences in user supplied file paths (bsc#1258954). Changelog: Update to version 1.59.90: + client: Fix use-after-free when creating async proxy failed + udisks2: Emit changed signals from update_all() + daemon: Fix race on subscribers list when on thread + ftp: Validate fe_size when parsing symlink target + ftp: Check localtime() return value before use + gphoto2: Use g_try_realloc() instead of g_realloc() + cdda: Reject path traversal in mount URI host + client: Fail when URI has invalid UTF-8 chars + udisks2: Fix memory corruption with duplicate mount paths + build: Update GOA dependency to > 3.57.0 + Some other fixes + ftp: Use control connection address for PASV data. + ftp: Reject paths containing CR/LF characters Update to version 1.59.1: + mtp: replace Android extension checks with capability checks + dav: Add X-OC-Mtime header on push to preserve last modified time + udisks2: Use hash tables in the volume monitor to improve performance + onedrive: Check for identity instead of presentation identity + build: Disable google option and mark as deprecated Update to version 1.58.2: + ftp: Use control connection address for PASV data + ftp: Reject paths containing CR/LF characters Update to version 1.58.1: + cdda: Fix duration of last track for some media + build: Fix build when google option is disabled + Fix various memory leaks + Updated translations. Update to version 1.58.0: + mtp: Allow cancelling ongoing folder enumerations + wsdd: Use socket-activated service if available + onedrive: Set emblem for remote data + fix: Add file rename support in MTP backend move operation + mtp: Fix -Wmaybe-uninitialized warning in pad_file + fuse: use fuse_(un)set_feature_flag for libfuse 3.17+ + smbbrowse: Purge server cache for next auth try + metatree: Open files with O_CLOEXEC + cdda: Fix incorrect track duration for 99-track CDs + metadata: Fix journal file permissions inconsistency + dav: recognize 308 Permanent Redirect Changes for gnome-online-accounts: Update to version 3.58.0: + SMTP server without password cannot be configured + Remove unneeded SMTP password escaping + build: Disable google provider Files feature + MS365: Fix mail address and name + Google: Set mail name to presentation identity + Updated translations. Update to version 3.57.1: + Default Microsoft 365 client is unverified + Microsoft 365: Make use of email for id + goadaemon: Allow manage system notifications + goamsgraphprovider: bump credentials generation + goaprovider: Allow to disable, instead of enable, selected providers Changes from version 3.57.0: + Support for saving a Kerberos password to the keychain after the first login + changing expired kerberos password is not supported. + Provided Files URI does not override undiscovered endpoint + DAV client rejects 204 status in OPTIONS request handler + Include emblem-default-symbolic.svg + Connecting a Runbox CardDAV/CalDAV account hangs/freezes after sign in + i81n: fix translatable string + goaimapsmptprovider: fix accounts without SMTP or authentication-less SMTP + build: only install icons for the goabackend build + build: don't require goabackend to build documentation + ci: test the build without gtk4 + DAV-client: Added short path for SOGo Update to version 3.56.4: + Bugs fixed: - Unclear which part of "IMAP+SMTP" account test failed - Adding nextcloud account which has a subfolder does not work - goadaemon: Handle broken account configs Update to version 3.56.3: - Add DAV detection and configuration for SOGo - DAV discovery fails when certain SRV lookups fail Update to version 3.56.1: - Support for saving a Kerberos password after the first login - Changing expired kerberos password is not supported - Provided Files URI does not override undiscovered endpoint - DAV client rejects 204 status in OPTIONS request handler Update to version 3.56.0: + Code style and logging cleanups + Updated translations Update to version 3.55.2: + goaoauth2provider: improve error handling for auth/token endpoints Update to version 3.55.1: - Support Webflow authentication for Nextcloud - Rename dconf key in gnome-online-accounts settings - "Account Name" GUI field is a bit ambiguous - Failed to generate a new POT file for the user interface of "gnome-online-accounts" (domain: "po") and some missing files from POTFILES.in Update to version 3.55.0: - Add progress spinner for OAuth2 dialogs - Remove Windows Live! option - Improve goa_oauth2_provider_ensure_credentials_sync - Authentication failure in goa IMAP accounts - Missing files from POTFILES.in - WebDAV not detected for mail.ru - goaoauth2provider: fix task chaining for subclasses - Always lowercase domains when looking up base - goadavclient: check Nextcloud fallback last - goabackend: add a composite widget for authflow links - goadavclient: fix the mailbox.org preconfig Update to version 3.54.5: - Adding GOA account fails with sonic.net IMAP service - Cannot add a ProtonMail bridge with IMAP + TLS - Nextcloud login does not work anymore due to OPTIONS /login request - Linked online accounts no longer work - Invalid URI when adding Google account - goamsgraphprovider: ensure a valid PresentationIdentity - goadaemon: complete GTasks to avoid a scary debug warning

No weakness data has been published for this record.