-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 23 Sep 2026 13:16:29 +0100
Source: xdg-dbus-proxy
Binary: xdg-dbus-proxy xdg-dbus-proxy-dbgsym xdg-dbus-proxy-tests xdg-dbus-proxy-tests-dbgsym
Architecture: amd64
Version: 0.1.6-1+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: amd64 / i386 Build Daemon (x86-csail-01) <buildd_amd64-x86-csail-01@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 xdg-dbus-proxy - filtering D-Bus proxy
 xdg-dbus-proxy-tests - filtering D-Bus proxy - as-installed tests
Closes: 1148782
Changes:
 xdg-dbus-proxy (0.1.6-1+deb13u3) trixie-security; urgency=high
 .
   * d/p/CVE-2026-94422/*.patch:
     Apply patches from upstream release 0.1.9 to fix message filtering
     bypass vulnerabilities.
     A malicious or compromised Flatpak app could use these vulnerabilities
     to escape the sandbox and execute arbitrary code on the host.
     (CVE-2026-94422, GHSA-2cgv-pwcq-wvpq, Closes: #1148782)
   * Mention CVE-2026-93676, #1144129 in previous changelog entry
Checksums-Sha1:
 b9df18f2a73e86fdb1c58eea99554202abebf9ae 70512 xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_amd64.deb
 df9c3b91f99c60c650e58ef4af97b70543a6bbf7 26520 xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_amd64.deb
 f02eb316c8b6fa5abf6bab06635d47c789328c94 15360 xdg-dbus-proxy-tests_0.1.6-1+deb13u3_amd64.deb
 0a645c59740714f385f004c68f8b4e4103eda41a 8984 xdg-dbus-proxy_0.1.6-1+deb13u3_amd64-buildd.buildinfo
 2734b01e339e79789027fc4d3f75682920dac1a8 26060 xdg-dbus-proxy_0.1.6-1+deb13u3_amd64.deb
Checksums-Sha256:
 9c4e505db09a116804803b09282c4f6cd1a3e8b8402775c861d8fa648c89d3a8 70512 xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_amd64.deb
 618a4e446d5831d59876f2cf9b874d2c52b65e873e343c94760bf5e4daf10201 26520 xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_amd64.deb
 cdd90fb6b114dd7223df2bff9735d13905205ac1c4ff1e24f2d1b53aeb2e2585 15360 xdg-dbus-proxy-tests_0.1.6-1+deb13u3_amd64.deb
 75208f824935d58864f184e1f8e5f5e1ea10a251b915c60c3c94521f58622e5f 8984 xdg-dbus-proxy_0.1.6-1+deb13u3_amd64-buildd.buildinfo
 29bd2f3e1172640ce40289fadfcb632bc3fed33a6bf342c3976b25ad9026da0f 26060 xdg-dbus-proxy_0.1.6-1+deb13u3_amd64.deb
Files:
 e2d977bc5f0447f1d4a29ec546ae3b47 70512 debug optional xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_amd64.deb
 7737ca313bab472e91d631d7096146eb 26520 debug optional xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_amd64.deb
 b85d72a6b589b78db11db10ca3f7654d 15360 admin optional xdg-dbus-proxy-tests_0.1.6-1+deb13u3_amd64.deb
 f2cc3061a95b632a2bb75d774fa22ae4 8984 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_amd64-buildd.buildinfo
 beea4711259fa9128b9a0723803e33fe 26060 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBDWXQb2umOtH4DRpYg9P9sm2dfEFAmqz7YwACgkQYg9P9sm2
dfEf+Q//UdKvK15xQk/+oII3tqnugR6M9DJr2XjGqkKOoo+WYTWHfwLk5A+aKRVM
8mM9D8OdG69jyqaQCGNz5dCOoucNekZG/GrdYtcCbZuP9AAHDQS4r9vAG0jWYD3q
nmsOVA53Jw+Lk5w4jgzq/ZkETe57MCMRDZ7DojiPgAMru/67T7VxfeDgc9yjP0Oa
kppKabjI54QNi/z26MpwgmCPvjxrVHoRzHcTANXzTVmchRJzREoCFg675SHTTBML
1X2nSJV2h1VV+30Wrg9G0OYrXiqFF5C6uFl0wIdwAc3duYabvFUU2mKD2Rt3krFl
u6yZ8kV/Q1fYXxwokdQhK3y+VkSuhU9EWNU53jVPyjpeQKhguN9xRsxfz9utJTNd
RNt5d1WSmhBz+VOISPJc+bGgrQ6JmP5yLYuqL+fFjZA56zrO5Pcovmis9XOw0Ck+
PM5HJKchtg0l1v1tAeIV8pDexlc7S/tlzzOQqwePui1vBj3sVgJce2osQ/lIDN0m
2uzVwGf/Z25rh6OkAOWgDSFoAu9Zt1CLfhjb3YkrWujnElw1EGEaacMGHuhtuaHs
NIcnvN4aDK6G95Ur64uEBGkk0FC/tlaIoUAVdoYCo2eVIclSnBGZNbV8Vcmo5+m9
zhU9z6Ca58w1S1LG00JvI/85lrKmV7RPkTzkUGyWKtYNYcjdGKA=
=KtV9
-----END PGP SIGNATURE-----