[ubuntu/questing-security] gvfs 1.57.2-2ubuntu5.1 (Accepted)

[Marc Deslauriers]

gvfs (1.57.2-2ubuntu5.1) questing-security; urgency=medium

  * SECURITY UPDATE: open port probe via FTP backend
    - debian/patches/CVE-2026-28295.patch: use control connection address
      for PASV data in daemon/gvfsbackendftp.c, daemon/gvfsbackendftp.h,
      daemon/gvfsftptask.c.
    - CVE-2026-28295
  * SECURITY UPDATE: arbitrary FTP command injection via CRLF
    - debian/patches/CVE-2026-28296.patch: reject paths containing CR/LF
      characters in daemon/gvfsbackendftp.c, daemon/gvfsftpfile.c,
      daemon/gvfsftpfile.h.
    - CVE-2026-28296

Date: 2026-03-18 16:34:17.136096+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/gvfs/1.57.2-2ubuntu5.1
-------------- next part --------------
Sorry, changesfile not available.