[From nobody Wed Oct 14 22:45:06 2026 Received: (at 1150932-done) by bugs.debian.org; 14 Oct 2026 21:42:43 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-111.4 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FROMDEVELOPER,HAS_BUG_NUMBER,SPF_HELO_NONE,SPF_PASS, USER_IN_DKIM_WELCOMELIST,VERSION autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 18; hammy, 150; neutral, 45; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <jbicha@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:42904) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <jbicha@debian.org>) id 1xH6kF-008Xsu-13 for 1150932-done@bugs.debian.org; Wed, 14 Oct 2026 21:42:43 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Transfer-Encoding:Content-Type :To:Subject:Message-ID:Date:From:In-Reply-To:References:MIME-Version:Reply-To :Cc:Content-ID:Content-Description; bh=jvdMh8f9ZanSzhPx0sL5zBoqywsS7bgGojIFgJ0ZuqY=; b=R3jmrLHtMh/lFqrvqMmhkHMnDr ruoNh9USCnv2ilP/na194Ryk2Sx9QXZoujU9eGyzVXNlcJ6GEgz+NybTrf0d5fsmPX5QwtEu5uvxK G2yg50ZoyBQ78hu72Ma7t20k/jEY2V9Ly/9cDD8qxZZJGM10Ca+wSnAfh/XZPl7bf0qFo8dnw9Q8W ci16Y8zK/bnXsYjAsv3KUc+PxZSqrLne+2O+jp9YLTzsPIt45s7yuYKsuc7tREHUhWD0KIppGYBAR wy18X9/DbVpz23pL5Y+EHG6yz61eR2ESkH4BEc/UkiS1vYYLRhoIif1KMFVY70Y7571mVwx8qo7q+ cmyS+n6w==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <jbicha@debian.org>) id 1xH6kD-004iE9-1o for 1150932-done@bugs.debian.org; Wed, 14 Oct 2026 21:42:41 +0000 Received: by mail-dl1-f43.google.com with SMTP id a92af1059eb24-15ea896ddc8so2119948c88.0 for <1150932-done@bugs.debian.org>; Wed, 14 Oct 2026 14:42:41 -0700 (PDT) X-Forwarded-Encrypted: i=1; AKwUvBxJVbBRKIp7+iEZxUTVcdlcTRUR+8R3F56hRrndKtsJGxuFa6FjUBGBq4JagSOWMCoWaojXAjDR5w9iOp4=@bugs.debian.org X-Gm-Message-State: AFq9FYLT+DoFSyPjkWGxKm29deEvCc/5lS1LVliARz/ifjS9of+TkugD 4z2Zw3QigB5PsiFndJJYWdm9/GFvOQNfrJfLhkXrFfICHxj6Px3RRc4wni8ZVaBj8IOmMtxPCdL 6VIrOD3d4GGlAR0YfYdljykIvzOTGpyhozC39E2ywP01TWa8UkGgf3M55E9782jJ6wY5fLbvo4d Zco7fh2PRL4D/OQSmhma0elHb/CpPhxQ== X-Received: by 2002:a05:701b:2810:b0:14c:d8d9:9502 with SMTP id a92af1059eb24-16a5e49fe06mr25395831c88.14.1792014159323; Wed, 14 Oct 2026 14:42:39 -0700 (PDT) MIME-Version: 1.0 References: <as_w0RupPsQhtfXC@pisco.westfalen.local> In-Reply-To: <as_w0RupPsQhtfXC@pisco.westfalen.local> From: =?UTF-8?Q?Jeremy_B=C3=ADcha?= <jbicha@debian.org> Date: Wed, 14 Oct 2026 23:42:00 +0200 X-Gmail-Original-Message-ID: <CAAajCMb+jHdqZbhTy-JG8x=UreeKYvoMpNGCJjya7E4cFNSXDg@mail.gmail.com> X-Gm-Features: AclHuK-1NwtEF5obGo7SH5TDgSiMK4ZHboHEclYRg1YGet7xiKfrGI5tL639l3w Message-ID: <CAAajCMb+jHdqZbhTy-JG8x=UreeKYvoMpNGCJjya7E4cFNSXDg@mail.gmail.com> Subject: Re: Bug#1150932: mutter: CVE-2026-108094 To: Debian Security Team <team@security.debian.org>, 1150932-done@bugs.debian.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Debian-User: jbicha Version: 50.5-1 On Wed, Oct 14, 2026 at 11:17=E2=80=AFPM Moritz M=C3=BChlenhoff <jmm@inutil= .org> wrote: > CVE-2026-108094[0]: > | A use-after-free flaw was found in mutter in the Wayland color- > | management ICC image-description path. A local attacker who can run > | a malicious Wayland client can destroy a wp_image_description_v1 > | resource while an asynchronous ICC file read is still in progress. > | When the read completes, the compositor uses the freed wl_resource, > | writes into freed memory, and frees a pointer derived from that > | memory. This can crash the GNOME session and may allow arbitrary > | code execution within the compositor process. > > https://bugzilla.redhat.com/show_bug.cgi?id=3D2549511 It looks like this issue was already fixed in upstream 50.5. I haven't checked whether Debian 13 is affected. The Red Hat bug suggests that mutter 48 might not be affected but the wording is confusing. Thank you, Jeremy B=C3=ADcha]