Bug#1150932: mutter: CVE-2026-108094

[Salvatore Bonaccorso]

Hi Jeremy,

> > https://bugzilla.redhat.com/show_bug.cgi?id=2549511
> 
> It looks like this issue was already fixed in upstream 50.5. I haven't
> checked whether Debian 13 is affected. The Red Hat bug suggests that
> mutter 48 might not be affected but the wording is confusing.

My understanding was that it is 47 onwards. And trixie with 48 has the
source file at least as well:

Contents-source-sid.gz:src/3rdparty/chromium/third_party/mutter/src/src/wayland/meta-wayland-color-management.c    qt6-webengine
Contents-source-sid.gz:src/wayland/meta-wayland-color-management.c mutter
Contents-source-trixie.gz:src/wayland/meta-wayland-color-management.c      mutter

but have not inspected the code further, but Red Hat bugzilla say
similar:

Component affected: mutter (src/wayland/meta-wayland-color-management.c — creator_icc_create / on_icc_create_bytes_read)
Version affected (maintainer): >= 47.0, < 51.0
Version fixed (maintainer): 51.0

but if futher investigation shows 48 from trixie is not shipping the
code then we can update the tracker!

Regards,
Salvatore