{"id":257770,"date":"2026-09-25T12:20:21","date_gmt":"2026-09-25T09:20:21","guid":{"rendered":"https:\/\/digitrendz.blog\/z\/?p=257770"},"modified":"2026-09-25T12:20:21","modified_gmt":"2026-09-25T09:20:21","slug":"gnome-50-5-patch-fixes-gvfs-cve-and-epiphany-code-injection","status":"publish","type":"post","link":"https:\/\/digitrendz.blog\/z\/tech-news\/257770\/gnome-50-5-patch-fixes-gvfs-cve-and-epiphany-code-injection\/","title":{"rendered":"GNOME 50.5 Patch Fixes gvfs CVE and Epiphany Code Injection"},"content":{"rendered":"
\u25bc Summary<\/summary>

– The GNOME Release Team shipped version 50.5 on September 24, updating 22 modules to address critical security vulnerabilities.
– Epiphany browser was updated to fix JavaScript injection flaws and a ZIP slip path traversal vulnerability in WebExtension files.
– The gvfs file system layer received a patch for CVE-2026-88924 by ensuring socket ownership is set correctly before creation.
– Memory safety issues were resolved in librsvg and GDM login manager, including use-after-free bugs that could crash sessions.
– Additional hardening measures were applied to GNOME Shell and libraries like libgsf and libsecret to prevent file handling exploits.
<\/p><\/details>\n\n

<\/p>\n\n

T<\/mark>he GNOME Release Team<\/a><\/strong> officially launched GNOME 50.5<\/a><\/strong> on September 24, delivering a critical update that addresses several security vulnerabilities across its core ecosystem. This release updates 22 modules and targets specific flaws in the gvfs<\/a><\/strong> file system layer, the Epiphany<\/a><\/strong> web browser, and the librsvg<\/a><\/strong> image library. The team emphasized the urgency of these patches, stating, \u201cAll operating systems shipping GNOME 50 are encouraged to upgrade.\u201d Users relying on Epiphany for browsing, librsvg for viewing SVG images, or gvfs for file access remain vulnerable until their respective distributions integrate these new packages.<\/p>\n\n

Securing the Web Browser and File System<\/h2>\n\n

Epiphany advances from version 50.4 to 50.6 within this release cycle, incorporating two significant August updates. Version 50.6, released on August 13, resolves a JavaScript code injection<\/strong> vulnerability triggered by CSS selectors in the autofill feature. It also addresses a path traversal flaw in WebExtension XPI files known as ZIPSLIP<\/a><\/strong>. In a ZIP slip attack, a maliciously crafted archive can write files outside its designated directory, potentially allowing an extension package to place files elsewhere on the disk. Additionally, version 50.5 introduces quoting mechanisms for command-line input before Epiphany passes it to the shell. Both versions also resolve crashes associated with the password manager and invalid bookmark imports.<\/p>\n\n

The gvfs<\/strong> component, specifically version 1.60.3, is the sole module assigned a Common Vulnerabilities and Exposures identifier in the release notes: CVE-2026-88924<\/a><\/strong>. The remediation involves ensuring the admin backend sets ownership on its socket prior to creation. The changelog provides only a single line of description for this fix without assigning a severity score, leaving system administrators to assess the risk level based on that limited entry.<\/p>\n\n

Addressing Memory Corruption and Authentication Issues<\/h2>\n\n

Memory management errors were corrected in both the image rendering engine and the login manager. librsvg<\/strong> version 2.62.4 fixes a use-after-free<\/strong> bug, where a program continues to use memory that has already been released. This issue was triggered by duplicate XML entities found in nested XInclude documents. The librsvg update also incorporates updates to two Rust dependencies to address advisories RUSTSEC-2026-0187<\/strong> and RUSTSEC-2026-0204<\/strong>.<\/p>\n\n

The display manager, GDM<\/strong> version 50.3, rectifies two use-after-free bugs. One of these defects could cause a complete user session crash during screen lock or unlock operations. GDM also repairs a regression caused by a previous security patch that inadvertently broke authentication on systemd. Meanwhile, GNOME Shell<\/strong> version 50.5 now prevents screen unlocking after a screen time limit expires and cancels mount password dialogs when the screen locks. It also validates serialized image data before creating a pixbuf.<\/p>\n\n

Further hardening efforts include updates to libgsf<\/a><\/strong> and libsecret<\/a><\/strong>. Version 1.14.59 of libgsf protects its OLE2 loader against runaway recursion and fixes zip reads on corrupted streams. The file backend for libsecret gains file locking capabilities to prevent concurrent writes from racing, ensuring data integrity during simultaneous access attempts.<\/p>\n\n(Source: Help Net Security<\/a>)<\/em>","protected":false},"excerpt":{"rendered":"

The GNOME Release Team launched version 50.5 on September 24 to address critical security vulnerabilities in core components like gvfs, Epiphany, and librsvg. Key fixes include patching JavaScript injection and ZIP slip flaws in the Epiphany browser, resolving a CVE in the gvfs file system layer,…<\/p>\n","protected":false},"author":1,"featured_media":257769,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"cybocfi_hide_featured_image":"","footnotes":""},"categories":[57,3327,3296,3254],"tags":[258276,258272,258273,258274,258275],"entities":[258285,258279,258282,258277,258278,258283,258280,258286,258281,258287,258284],"class_list":["post-257770","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech-news","category-newswire","category-startups","category-technology","tag-epiphany","tag-gvfs","tag-libgsf","tag-librsvg","tag-zipslip","entity-cve-2026-88924","entity-epiphany","entity-gdm-50-3","entity-gnome-50-5","entity-gnome-release-team","entity-gnome-shell-50-5","entity-gvfs","entity-libgsf","entity-librsvg","entity-libsecret","entity-zipslip"],"_links":{"self":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/257770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/comments?post=257770"}],"version-history":[{"count":2,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/257770\/revisions"}],"predecessor-version":[{"id":257796,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/257770\/revisions\/257796"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media\/257769"}],"wp:attachment":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media?parent=257770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/categories?post=257770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/tags?post=257770"},{"taxonomy":"entity","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/entities?post=257770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}