SUSE-SU-2026:4240-1: gvfs&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:4240-1 is a vulnerability in gvfs&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 17-09-2026
   PublishedVulnerability first disclosed.
2. 17-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for gvfs This update for gvfs fixes the following issues: - CVE-2026-84267: `read_string()` allocates buffers withouth verifying that the buffer is completely filled when communicating with a malicious SFTP server, which can lead to uninitialized heap memory leaks (bsc#1278157). - CVE-2026-84268: `read_reply()` processes length that exceeds requested client size when communicating with a malicious SFTP server, which can lead to an OOB write (bsc#1278158). - CVE-2026-84269: DSI read path processes length that exceeds requested client size when communicating with a malicious AFP server, which can lead to an OOB memory access (bsc#1278159). - CVE-2026-84270: `do_read()` trusts the data length returned by a mounted MTP device and does not limit it to the original size requested by the client, which can lead to an OOB write (bsc#1278156).

No weakness data has been published for this record.