[ubuntu/noble-security] gvfs 1.54.4-0ubuntu1~24.04.2 (Accepted)

[Marc Deslauriers]

gvfs (1.54.4-0ubuntu1~24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: open port probe via FTP backend
    - debian/patches/CVE-2026-28295.patch: use control connection address
      for PASV data in daemon/gvfsbackendftp.c, daemon/gvfsbackendftp.h,
      daemon/gvfsftptask.c.
    - CVE-2026-28295
  * SECURITY UPDATE: arbitrary FTP command injection via CRLF
    - debian/patches/CVE-2026-28296.patch: reject paths containing CR/LF
      characters in daemon/gvfsbackendftp.c, daemon/gvfsftpfile.c,
      daemon/gvfsftpfile.h.
    - CVE-2026-28296

Date: 2026-03-18 16:34:32.753952+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/gvfs/1.54.4-0ubuntu1~24.04.2
-------------- next part --------------
Sorry, changesfile not available.