[From nobody Tue Aug 11 14:21:05 2026
Received: (at submit) by bugs.debian.org; 11 Aug 2026 12:24:38 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-118.2 required=4.0 tests=ALL_TRUSTED,BAYES_00,
 BODY_INCLUDES_PACKAGE,DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,
 DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FROMDEVELOPER,HAS_PACKAGE,
 SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 14; hammy, 150; neutral, 95; spammy,
 0. spammytokens:
 hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin,
 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311,
 0.000-+--H*RT:311, 0.000-+--H*RT:108
Return-path: <smcv@debian.org>
Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:44758)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <smcv@debian.org>) id 1wtlX4-00AsCP-1L
 for submit@bugs.debian.org; Tue, 11 Aug 2026 12:24:38 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; 
 s=smtpauto.stravinsky;
 h=X-Debian-User:Content-Transfer-Encoding:Content-Type
 :MIME-Version:Message-ID:Subject:To:From:Date:Reply-To:Cc:Content-ID:
 Content-Description:In-Reply-To:References;
 bh=MWZF+a/3u+g2/WZgqTavRn9R1aZuVTZoVmSt85IQmw8=; b=nnkmDXVpJTT1d8Ri3N15kgHOsX
 xTUWkpgo10c9+PkX7YPrdCCsZWHp3U38xzUddRURkR2BaHVHjiCTmp5k5DOUsRzy0v6CdC3IVKj82
 E9dKv8ElCY1Nc6OXOzTaiBE/HmARUz6osDIB54rMFNoiz8zb4YD8lpmnNmhduLTSdLyhbQV4HLcPI
 WT9NzxghwpKNKgSIrNUvQ1Keerz1hxD971fW8fHbb3TDey01fjy1k22Tl9QM+2t5t9s5AjyVh9O9p
 SaWpLnMW9C45G7E5ItUoYy7uVXGcVtkQJ/ASaAG7hjb7YqCUtu2NZlkysHUEnKDbg0MyKeDlrPDwN
 2F93vprw==;
Received: from authenticated-user by stravinsky.debian.org with esmtpsa
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <smcv@debian.org>) id 1wtlX2-003YnS-2i
 for submit@bugs.debian.org; Tue, 11 Aug 2026 12:24:36 +0000
Date: Tue, 11 Aug 2026 13:24:35 +0100
From: Simon McVittie <smcv@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: xdg-dbus-proxy: GHSA-r7hp-698j-2h6c: filtering for broadcast
 messages bypasses path/interface/member checks
Message-ID: <ansUg9Avjw6FGeJX@definition.pseudorandom.co.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
X-Mutt-Fcc: =.lists.debian/
X-Reportbug-Version: 13.2.0+nmu1
X-Debian-User: smcv
Delivered-To: submit@bugs.debian.org

Package: xdg-dbus-proxy
Version: 0.1.6-1
Severity: important
Tags: security pending
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

In xdg-dbus-proxy versions 0.1.6 and 0.1.7 (only), filtering for 
broadcast messages bypasses the intended path/interface/member checks. A 
malicious or compromised Flatpak app could monitor any broadcast signal 
on the D-Bus session bus or the AT-SPI bus, obtaining information that 
was not intended to be available to it.

Similarly, if a non-Flatpak app framework uses

    xdg-dbus-proxy … --broadcast=…

or

    xdg-dbus-proxy … --call=…

then a compromised or malicious app in that framework could monitor 
broadcast signals on the affected bus.

This is fixed in upstream release 0.1.8.

Note that fixing this may cause regressions unless app frameworks are
updated appropriately:

  * Flatpak versions 1.15.9 and up attempt to allow sandboxed apps to
    receive two broadcast signals on the AT-SPI bus, but the --broadcast
    command-line options that Flatpak passed to xdg-dbus-proxy were
    incorrect. As a result, fixing this vulnerability will regress
    accessibility features for Flatpak apps, unless Flatpak is also updated
    to correct its --broadcast rules. This is fixed in Flatpak versions
    1.18.1 and newer (coming soon) by commit
    "run-dbus: Correct --broadcast rules for the AT-SPI bus".
  * If a legitimate Flatpak app was relying on being able to receive
    broadcast signals from a service for which it did not have a --talk-name
    or --system-talk-name permission, this would accidentally have worked as
    a result of this vulnerability, but will fail after this vulnerability
    is fixed. This can be addressed by updating any affected Flatpak apps'
    metadata to request an appropriate --talk-name or --system-talk-name
    permission.
  * If other app frameworks use xdg-dbus-proxy, the framework or its apps
    might experience similar regressions, which can be addressed by adding
    suitable --broadcast or --talk rules to its xdg-dbus-proxy invocation.

Preparing 0.1.8-1 for unstable soon, and I've already contacted the 
security team regarding a trixie backport.

    smcv
]