OPENSUSE-SU-2026:21875-1: gvfs&distro=openSUSE Leap 16.0 openSUSE
Vulnerability summary
OPENSUSE-SU-2026:21875-1 is a vulnerability in gvfs&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.
Advisory lineage
Upstream 4 · Downstream 0 · Related 4Timeline
- 18-09-2026PublishedVulnerability first disclosed.
- 25-09-2026Last modifiedVulnerability information updated.
Description
Security update for gvfs This update for gvfs fixes the following issues: - CVE-2026-84267: `read_string()` allocates buffers withouth verifying that the buffer is completely filled when communicating with a malicious SFTP server, which can lead to uninitialized heap memory leaks (bsc#1278157). - CVE-2026-84268: `read_reply()` processes length that exceeds requested client size when communicating with a malicious SFTP server, which can lead to an OOB write (bsc#1278158). - CVE-2026-84269: DSI read path processes length that exceeds requested client size when communicating with a malicious AFP server, which can lead to an OOB memory access (bsc#1278159). - CVE-2026-84270: `do_read()` trusts the data length returned by a mounted MTP device and does not limit it to the original size requested by the client, which can lead to an OOB write (bsc#1278156).
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Opensuse1 product
- gvfs&distro=openSUSE Leap 16.0< 1.59.90-160000.3.1
1 vendor · 1 product