-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 23 Sep 2026 13:16:29 +0100
Source: xdg-dbus-proxy
Binary: xdg-dbus-proxy xdg-dbus-proxy-dbgsym xdg-dbus-proxy-tests xdg-dbus-proxy-tests-dbgsym
Architecture: i386
Version: 0.1.6-1+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-02) <buildd_amd64-x86-conova-02@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 xdg-dbus-proxy - filtering D-Bus proxy
 xdg-dbus-proxy-tests - filtering D-Bus proxy - as-installed tests
Closes: 1148782
Changes:
 xdg-dbus-proxy (0.1.6-1+deb13u3) trixie-security; urgency=high
 .
   * d/p/CVE-2026-94422/*.patch:
     Apply patches from upstream release 0.1.9 to fix message filtering
     bypass vulnerabilities.
     A malicious or compromised Flatpak app could use these vulnerabilities
     to escape the sandbox and execute arbitrary code on the host.
     (CVE-2026-94422, GHSA-2cgv-pwcq-wvpq, Closes: #1148782)
   * Mention CVE-2026-93676, #1144129 in previous changelog entry
Checksums-Sha1:
 03ac8b78b4caf98d0b11859a72095a9b9217520b 66236 xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_i386.deb
 ca6c53ac2c2bfc108d592a02a4cecda178c6baf0 23256 xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_i386.deb
 51f40cdf6eee4ddaee018e3c966104e33428ced8 15480 xdg-dbus-proxy-tests_0.1.6-1+deb13u3_i386.deb
 59759b9b45ad8e193a5a837c6e7b9badf1196970 8879 xdg-dbus-proxy_0.1.6-1+deb13u3_i386-buildd.buildinfo
 6dc66c75957825f5ae0cb61dfbed602591adf67f 28200 xdg-dbus-proxy_0.1.6-1+deb13u3_i386.deb
Checksums-Sha256:
 1903808c28d20953f6da74caad21462c298ce8f9665e6f085b3f7898c76b483b 66236 xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_i386.deb
 8890b35d3fe6d55a40acd8c9c2f64d2c11ea2220530e66b3f0b94a8bf635c659 23256 xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_i386.deb
 7bf37ef8c1e5730e20ab746ecc5cf25ff242a9ea18c50a295df24cb677dc64a5 15480 xdg-dbus-proxy-tests_0.1.6-1+deb13u3_i386.deb
 8f6cbdb81c01f6539a9fa6fb461b2d3a593463536a9fd3a53edad31b0f6140a5 8879 xdg-dbus-proxy_0.1.6-1+deb13u3_i386-buildd.buildinfo
 661ed9a0bab9bb1f304279c06be5c55297184bd4be93f94d86745a383be7d278 28200 xdg-dbus-proxy_0.1.6-1+deb13u3_i386.deb
Files:
 215ca80916509e01312b7364eb689d85 66236 debug optional xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_i386.deb
 37b55a2f7984af8ac1b0349627316dad 23256 debug optional xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_i386.deb
 0055332852406993652419661dafb532 15480 admin optional xdg-dbus-proxy-tests_0.1.6-1+deb13u3_i386.deb
 ab3797956bcb7352080422a6e3092ae4 8879 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_i386-buildd.buildinfo
 4193e595f79f4dddcc705e67dfe687dc 28200 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE+i/sCsF3puL4e7qIGNGWmfrqILEFAmqz7cUACgkQGNGWmfrq
ILFPiBAAj50i7jIxf01yvOBejYVj8IwLv7ukBNsShGKgDmDWdsX/+3g2PFFdh+IP
B6f9E63nBX8pgZOXDqy7PRxcFgAj80qwjDO+TU1etc9YjYIS+6nD8j4M13rVOQtI
tFgyGo/bJ6gy3DvhugfKDfwbfSgC3k3MK+WQjLV9RHyiPgekyxJrKTc8f/AoSCO4
R0rbD+dymV7bOwZjUQaqUnLBfFND97C6xCqtbmrIhb1GqZNK/5Ae4teZxg/8lVdk
UAJqDk5RN1+8SfUdkiPA+z6ne0eqgqIuzex6cX60OpEUkCKsIgtKytcxFhOmYKSY
iHSTkOXPUPw2GTPKJpXUJnrzDYc4H8B2yyNIfOok8N7rGyd6decK4799QfDa1F4X
0lYBXBAgVskRab4MRmhiAmQwzusKHLotkj5dGGJmwObN+oH67ECNFaPNaSvXZnkb
5KTLoXeDy9UctJobjZdTfTkHy3jbM+G1YMA8r6Y/hh0kZSv/02/A6ID4dgmmXQKb
BVJWV2+w5fY/X6IUUDG2kub97F09wmdouM/8rJobYmCirQCAroFvvzeClatZuzW6
58EE92ysPa+ujmtBSfVxYh/VDNjYHntkGcyW9OYJnPoSKP3YA3X+ivR1EkKYj0il
DF2ku4e97fs5lbgoRerZF0K0vgPAN0I6IYOck/RMOQqPwArGYfc=
=ka09
-----END PGP SIGNATURE-----