[From nobody Thu Jun 18 11:51:05 2026 Received: (at 1091643-close) by bugs.debian.org; 18 Jun 2026 10:49:23 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 100; hammy, 150; neutral, 278; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:59068) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1waAJH-003XVd-1t for 1091643-close@bugs.debian.org; Thu, 18 Jun 2026 10:49:23 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1waAJF-003DWY-0C for 1091643-close@bugs.debian.org; Thu, 18 Jun 2026 10:49:21 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=OzR7CK+ABBHzC9KnsJT8MRMA21ouJlJsicAZUfpmhwo=; b=mRFwbq66O1wxJe8OnfmLoq8bQ6 b/NsE5nnm+I+RwGyx8uApM12QwTrJVl2jgHygsQrzG1l/UCZWtiKN9B6lxmaRRK/2yIi/DFQ/+QEb MR6XP+NNOqjCIoH0xOj/sEerwOlaKurkTz8RecroUuQ2KstQOwUvZLg2fgj3z07LMzrgEuX/Vn9qB yBdG64slD8cZA67WvsqugD4YNImh4S5t2g/O8z1IingkMq9dwe9W1EjK7Ce17lYWxUQ3dBdaRNC/b 6NJwHws8UJl1oWbrIYy/dESimbaHMuaAqNIo6KLAfIZt0XcCuKPFFX0IkuRpiQFfwfr1YflKld26V cP52fkqg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1waAJE-000000088kW-0RdB; Thu, 18 Jun 2026 10:49:20 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Simon McVittie <smcv@debian.org> To: 1091643-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: xdg-desktop-portal Debian: DAK Debian-Changes: xdg-desktop-portal_1.22.1+ds-1_source.changes Debian-Source: xdg-desktop-portal Debian-Version: 1.22.1+ds-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1091643: fixed in xdg-desktop-portal 1.22.1+ds-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============9069308631486050093==" Message-Id: <E1waAJE-000000088kW-0RdB@fasolo.debian.org> Date: Thu, 18 Jun 2026 10:49:20 +0000 --===============9069308631486050093== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: xdg-desktop-portal Source-Version: 1.22.1+ds-1 Done: Simon McVittie <smcv@debian.org> We believe that the bug you reported is fixed in the latest version of xdg-desktop-portal, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1091643@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Simon McVittie <smcv@debian.org> (supplier of updated xdg-desktop-portal pack= age) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 18 Jun 2026 11:22:44 +0100 Source: xdg-desktop-portal Architecture: source Version: 1.22.1+ds-1 Distribution: unstable Urgency: medium Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debi= an.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1091643 1132958 Changes: xdg-desktop-portal (1.22.1+ds-1) unstable; urgency=3Dmedium . * New upstream security fix release - Prevent a malicious or compromised sandboxed app from redirecting drag-and-drop and copy/paste data to itself (GHSA-c5cf-79w8-pvfh) - Prevent a malicious or compromised sandboxed app from gaining arbitrary write access to nonexistent files outside the sandbox (GHSA-cm83-2936-gxjm) - Validate all App IDs in the Document Portal to prevent maliciouss applications from providing a crafted App ID which causes the parsing of arbitrary files on the host as GLib.KeyFile (#2023 upstream) - Disable PipeWire's realtime module to prevent deadlocks (#2012 upstream) . xdg-desktop-portal (1.22.0+ds-1) experimental; urgency=3Dmedium . * New upstream release - Reports placeholder data for the root of the xdg-documents-portal filesystem, rather than an error (Closes: #1091643) * d/p/debian/allow-no-graphical-session-target.patch: Add patch from Ubuntu to avoid a regression in desktop environments that don't integrate with `systemd --user`. Thanks to Alessandro Astone (LP: #2144855) * d/watch, d/gbp.conf: Follow the 1.22.x branch * Revert "d/control, d/gbp.conf: Branch for experimental" . xdg-desktop-portal (1.21.1+ds-1) experimental; urgency=3Dmedium . * New upstream development prerelease - This version fixes a vulnerability in which a malicious or compromised Flatpak app could send any file or directory to the trash, including those outside its sandbox. (GHSA-rqr9-jwwf-wxgj) (Closes: #1132958) * Merge packaging from unstable * Drop patches that were applied upstream * Standards-Version: 4.7.4 (no changes required) * Normalize formatting of packaging (debputy reformat) Checksums-Sha1: 63edb4058138faa621b6ea1ea37d1e98598d6d6c 3316 xdg-desktop-portal_1.22.1+ds-1= .dsc e8698fa389c52461419f672a7dfa65a31d7a2e1c 918588 xdg-desktop-portal_1.22.1+ds= .orig.tar.xz 2fd7fb8f44a94e08227d85ff783a3047f428a0ec 16664 xdg-desktop-portal_1.22.1+ds-= 1.debian.tar.xz 1925ec0f0ea642c91ed826b4951dd2a9c0810d97 18961 xdg-desktop-portal_1.22.1+ds-= 1_source.buildinfo Checksums-Sha256: 467e9d42cdc8f419d357a621d5dea37e43e81e44cb405f3404d7580d0a354a27 3316 xdg-de= sktop-portal_1.22.1+ds-1.dsc 97169dc09c91b619c554def9158df2a6faec8e614af29f064feceb5c22188a9f 918588 xdg-= desktop-portal_1.22.1+ds.orig.tar.xz 4005e07af0d2cb08fd4d8426a597703c912fb158e75c1399bd81d4cbc05fafb1 16664 xdg-d= esktop-portal_1.22.1+ds-1.debian.tar.xz a222a989e62f089cd760e2e5fd4017a4aba3634e818a7be1b68cdce7b24f1bdc 18961 xdg-d= esktop-portal_1.22.1+ds-1_source.buildinfo Files: e7f1e970387ec4b1b5d654bdba2a989f 3316 admin optional xdg-desktop-portal_1.22= .1+ds-1.dsc 1119061f82e2ae45cf010b9c2ca82e0d 918588 admin optional xdg-desktop-portal_1.= 22.1+ds.orig.tar.xz ef98409dbb5181b4b7f682e330b74333 16664 admin optional xdg-desktop-portal_1.2= 2.1+ds-1.debian.tar.xz c9650060b555a1062bb7f12b4bbfc317 18961 admin optional xdg-desktop-portal_1.2= 2.1+ds-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmozymQACgkQI1wJnT6z MHa8pA//UbegD2ImKsPVIa64qD1fwlo3eKnZOt/yOk4MkqaB9s3pOsmE2QF0AmNt Uu5tc4jAM/sB2JYYiMT1uYszctjaBkYYOKQ4EQFUW9MqIyXEO7fD2uz8fkF39hVk 3sSG8yB0IfXIzwhjPLETTW7oXbYo1zjyp1T4WUtD+H7FoYizFa77o5PSt8M+vN2q PwMAB+W6xXsVKOXn9yFJXU3m9F2WatT8tLAiqcpI1O4W9wHhjFcK6ih710VFS6q+ H3bX0H8HIRF8YvfXxoLVJ0wB7na/OkqvnpP9/UWNuyUeiK9FfHipk+/8VsRiBIrZ /qw3k7JbdQtr76+AWhNUKbovBWXuyyR7IXKbIZHjRXr00Ofs4tua+GtJRqhtr3oB efsM2TClzfy+SQSDr14XtPTXwC1f6yoW+5fGCYqHA5mDjGVkRovXZAWypYxt7+H6 7BWEf95cpahOTbB+ivq11OkQUq1eqcER9H/MG6BL7aSM7dtyOJsdIkV458IoNY6k g+/4s/4ZexHRKevzUQtxe+ey8/ykhyupZIRJmCQMI4J9Ux7FmPAl2wKNmK+geuGJ TJgmGxJWI4eFsDxyJ/sU4/cVKH/4ZDJjG96oMCenQCnr8pZVPPW3/qro3KH5kuAD W8CxVXq20ah/xYB02n7xTihP5fGUBviUibUEGukunWusLU7x48s=3D =3D+OhO -----END PGP SIGNATURE----- --===============9069308631486050093== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCajPNMAAKCRCb9qggYcy5 IbxhAP9epBHNFMRCbc1D+8G0vhP9CzL1pAhdSrHVGvy5r9lRvgD9Hmg2ShGGy38R Ad3nnwhSkv5l7NIDDVHhK9xQmb3yWQk= =+TK/ -----END PGP SIGNATURE----- --===============9069308631486050093==-- ]