[From nobody Fri Oct 2 16:27:07 2026 Received: (at 1148782-close) by bugs.debian.org; 2 Oct 2026 15:25:03 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 92; hammy, 150; neutral, 168; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:48260) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf8A-003kgo-06 for 1148782-close@bugs.debian.org; Fri, 02 Oct 2026 15:25:02 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf89-001Kce-0n for 1148782-close@bugs.debian.org; Fri, 02 Oct 2026 15:25:01 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=HPeSgeEYQwhm2h69GKedyWH+FdQd+dPDIDFQoF1BSuM=; b=MyvRmR2BiSwrKqgn97t7pTnx6+ HUh4dInOa/y0MCjTzT9jXxfMVsJ3a5abg0YP+jETd3DXx3q81C9MOD0GHWQKXi2mT6APfM4vn6l/9 2ZquUT+Ra46FHCQBBfsG2tkxWasWH4T/+sReDASaoibYwnJRCtE7aYxUcT2j2VcTsPBLv1gtakfty A5x+jTArxeHUx4HO6WW0LE9UYjqjMEKXf91KaASOL+cP6NLj4EnL1Qr1K3ylWy8BHkBv/MTeTPUqg aa49cYAUGYhC3itVe9O150hm9u5/fBM9Ax/mxFLUt5FZDTZFrjShLygHkuu6Ts4/D2YvIfKg3TwBT jrN2URaw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf88-0000000485v-0KXV; Fri, 02 Oct 2026 15:25:00 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Simon McVittie <smcv@debian.org> To: 1148782-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: xdg-dbus-proxy Debian: DAK Debian-Changes: xdg-dbus-proxy_0.1.6-1+deb13u3_source.changes Debian-Source: xdg-dbus-proxy Debian-Version: 0.1.6-1+deb13u3 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1148782: fixed in xdg-dbus-proxy 0.1.6-1+deb13u3 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============4055860856918913809==" Message-Id: <E1xCf88-0000000485v-0KXV@fasolo.debian.org> Date: Fri, 02 Oct 2026 15:25:00 +0000 --===============4055860856918913809== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: xdg-dbus-proxy Source-Version: 0.1.6-1+deb13u3 Done: Simon McVittie <smcv@debian.org> We believe that the bug you reported is fixed in the latest version of xdg-dbus-proxy, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1148782@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Simon McVittie <smcv@debian.org> (supplier of updated xdg-dbus-proxy package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 23 Sep 2026 13:16:29 +0100 Source: xdg-dbus-proxy Architecture: source Version: 0.1.6-1+deb13u3 Distribution: trixie-security Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debi= an.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1148782 Changes: xdg-dbus-proxy (0.1.6-1+deb13u3) trixie-security; urgency=3Dhigh . * d/p/CVE-2026-94422/*.patch: Apply patches from upstream release 0.1.9 to fix message filtering bypass vulnerabilities. A malicious or compromised Flatpak app could use these vulnerabilities to escape the sandbox and execute arbitrary code on the host. (CVE-2026-94422, GHSA-2cgv-pwcq-wvpq, Closes: #1148782) * Mention CVE-2026-93676, #1144129 in previous changelog entry Checksums-Sha1: 49ef3c4a3eecc3750cf058ded6cafd0d59cf7302 2232 xdg-dbus-proxy_0.1.6-1+deb13u3= .dsc 4c07aa2693bb12d6f5cb32b5e8693c98b53725e7 20724 xdg-dbus-proxy_0.1.6-1+deb13u= 3.debian.tar.xz f6dbc1a39474f6121bda0d872698158493b189da 7943 xdg-dbus-proxy_0.1.6-1+deb13u3= _source.buildinfo Checksums-Sha256: ab440e81165d397918024961c4b20ba58bb9e7d263554d1de8cbb54f9cd46b86 2232 xdg-db= us-proxy_0.1.6-1+deb13u3.dsc ca9cd0cde2b2d6371d5120dd74cfbf30f755875a3a084bfb466748ef56594e32 20724 xdg-d= bus-proxy_0.1.6-1+deb13u3.debian.tar.xz bd81c95c214be8a3c42f8e303c4df9edb58a0b6dc3dc4df405df79371f76cf6f 7943 xdg-db= us-proxy_0.1.6-1+deb13u3_source.buildinfo Files: ea3d428b78b291ef041d05b81b78c0e7 2232 admin optional xdg-dbus-proxy_0.1.6-1+= deb13u3.dsc 8748a0847cbaad3849be735856d73ec1 20724 admin optional xdg-dbus-proxy_0.1.6-1= +deb13u3.debian.tar.xz 8ab55748162f3d2ae0bd0e938ec2b102 7943 admin optional xdg-dbus-proxy_0.1.6-1+= deb13u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmqz5zIACgkQI1wJnT6z MHaEYA//ZB1nJgDdZweQ73k+fYZKXq4VbO2EguSfZbeOtEZpZR7ZSlbvZxdZCeNg n1eAY8+IVfGWCXRM2B/38K1rJT/eF4gFflnM+mNOjyX0wZBNb5TukEVKaya+qLbz waOuR+7ankH/DOj18A39S7bq2fl4j2dVgD4qSCkOiS42DxUIZDAXDoI+rURttbe9 VwPRWa/OxP4Pg5jAn/hPURYrA5KiUABvbUZ72ptcyRJOFG/ZBx6Oc83DLHzhrxbu iNA5Jd/3eRqzCwJGTrttP8FGlA47FE3Jfs+ZbqCISd4Ur68al8vZ5o5jtL5GKeaD pwrkoA7BIH6IcRfR6az88Y4Ev9It9qFnLwoa3vV5inLPo6+DgLvw+WJFA0oaHync HiTWiGdOI8lYeltIpAcfiT5wYF2FA9iAfSLG6Abpw+fE2DgPkMztF6oRD+MC+9DV 6NjZgeg+WNZsqiRaNtBdl/sflgOLZK1fZQJDQ08rmRG+wx56pfZcqZtWVjnYGqC+ 3MnyS/tmhoOBiuPYJf7eaeOeRlI4mQBfIdMDDp0F6Mnwwpzd+Q3nnuah8LlU3z+j IHVPJMVUrLgLCgXgFG+3afhk7pNsMUFXzRvGyktSe+digWsDwPQubRWofXabOK/w 1B+f6vKmQ1SZVZJH2E2VrbLxlrxpVD37TsCjmFeJ3mzuqpeXlSY=3D =3Dsko/ -----END PGP SIGNATURE----- --===============4055860856918913809== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCar/MzAAKCRCb9qggYcy5 IW+rAP9xMPXM8IbWDthCB8YY55H4Odvki9cRm5oSMExQNmCo5QD/T3pEfxCWn/6k AGTIVc3nmbV2Ge21CraDMhC5Oqd8Igg= =WfGM -----END PGP SIGNATURE----- --===============4055860856918913809==-- ]