Threats Tagged 'cve-2026-84268'

This advisory addresses security vulnerabilities in GVFS, the GNOME Virtual File System, affecting Red Hat Enterprise Linux 9. The update fixes a heap-based buffer overflow in the SFTP component and a local privilege escalation via a socket ownership race condition. These issues could allow local attackers to gain elevated privileges or cause memory corruption. The update is rated as important by Red Hat and applies to multiple architectures and variants of Red Hat Enterprise Linux 9.

This security advisory addresses vulnerabilities in GVFS, the GNOME Virtual File System, specifically a heap-based buffer overflow in the SFTP component and a local privilege escalation via a socket ownership race condition. The update is rated as important by Red Hat and affects Red Hat Enterprise Linux 10 and its variants. The vulnerabilities could allow local users to gain elevated privileges or cause memory corruption. A security update is available to remediate these issues.

CVE-2026-84267 is a vulnerability in the SFTP backend of GNOME gvfs where a malicious SFTP server can cause the client to leak uninitialized heap memory. This occurs because the read_string() function allocates a buffer without verifying it is fully filled, leading to uninitialized bytes being used as a file handle and echoed back to the server. The leaked memory includes the heap base and the load address of the libgio library, allowing deterministic defeat of ASLR. The vulnerability requires user interaction to connect to a malicious SFTP share and results in limited information disclosure without exposing user data. It has been rated with moderate severity and affects gvfs versions from 1.10.0 up to but not including 1.60.2.

A heap-based buffer overflow vulnerability (CVE-2026-84268) exists in the SFTP backend of gvfs. This flaw occurs when a malicious SFTP server sends a length value exceeding the allocated buffer size during file read operations, causing memory corruption. The issue can lead to denial of service or potentially arbitrary code execution in the gvfsd-sftp process. Red Hat has released security updates for Red Hat Enterprise Linux 8 and 10 to address this vulnerability.

CVE-2026-84268 is a heap-based buffer overflow vulnerability in the GNOME gvfs component, specifically in the SFTP protocol handling function read_reply(). This vulnerability has a high severity with a CVSS score of 8.8, indicating it can lead to high impact on confidentiality, integrity, and availability. The issue affects Red Hat Enterprise Linux 8 and related distributions. A security update addressing this vulnerability is available from Red Hat.

CVE-2026-84268 is a heap-based buffer overflow vulnerability in the SFTP backend of GNOME gvfs. A malicious SFTP server can cause the gvfsd-sftp process to write beyond allocated heap memory boundaries when reading a file, due to improper length verification in the read_reply() function. This can lead to process crashes or potentially arbitrary code execution. Red Hat has issued a security update addressing this flaw in gvfs versions prior to 1.60.2.