Your message dated Fri, 02 Oct 2026 15:25:00 +0000
with message-id <[email protected]>
and subject line Bug#1148782: fixed in xdg-dbus-proxy 0.1.6-1+deb13u3
has caused the Debian Bug report #1148782,
regarding xdg-dbus-proxy: CVE-2026-94422: Message filtering bypass via reply
serial (GHSA-2cgv-pwcq-wvpq)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148782: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148782
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: xdg-dbus-proxy
Version: 0.1.0-1
Severity: grave
Tags: security
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <[email protected]>
https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
>An incorrect implementation of message filtering in xdg-dbus-proxy
>versions before 0.1.9 allows an attacker to bypass the intended message
>filtering on the D-Bus session bus by setting a reply serial number on
>non-reply messages.
>
>xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak,
>but it is released as a separate project and is sometimes used by other
>app frameworks such as Firejail.
>
>Impact:
>
>A malicious or compromised Flatpak app could achieve arbitrary code
>execution outside its sandbox.
>
>If other app frameworks rely on xdg-dbus-proxy in the same way that
>Flatpak does, then they will have an equivalent vulnerability until
>xdg-dbus-proxy is updated.
>
>Workarounds:
>
>Avoid running untrusted Flatpak apps.
>
>Avoid running untrusted apps via other frameworks that use xdg-dbus-proxy.
--- End Message ---
--- Begin Message ---
Source: xdg-dbus-proxy
Source-Version: 0.1.6-1+deb13u3
Done: Simon McVittie <[email protected]>
We believe that the bug you reported is fixed in the latest version of
xdg-dbus-proxy, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Simon McVittie <[email protected]> (supplier of updated xdg-dbus-proxy package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 23 Sep 2026 13:16:29 +0100
Source: xdg-dbus-proxy
Architecture: source
Version: 0.1.6-1+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: Utopia Maintenance Team
<[email protected]>
Changed-By: Simon McVittie <[email protected]>
Closes: 1148782
Changes:
xdg-dbus-proxy (0.1.6-1+deb13u3) trixie-security; urgency=high
.
* d/p/CVE-2026-94422/*.patch:
Apply patches from upstream release 0.1.9 to fix message filtering
bypass vulnerabilities.
A malicious or compromised Flatpak app could use these vulnerabilities
to escape the sandbox and execute arbitrary code on the host.
(CVE-2026-94422, GHSA-2cgv-pwcq-wvpq, Closes: #1148782)
* Mention CVE-2026-93676, #1144129 in previous changelog entry
Checksums-Sha1:
49ef3c4a3eecc3750cf058ded6cafd0d59cf7302 2232
xdg-dbus-proxy_0.1.6-1+deb13u3.dsc
4c07aa2693bb12d6f5cb32b5e8693c98b53725e7 20724
xdg-dbus-proxy_0.1.6-1+deb13u3.debian.tar.xz
f6dbc1a39474f6121bda0d872698158493b189da 7943
xdg-dbus-proxy_0.1.6-1+deb13u3_source.buildinfo
Checksums-Sha256:
ab440e81165d397918024961c4b20ba58bb9e7d263554d1de8cbb54f9cd46b86 2232
xdg-dbus-proxy_0.1.6-1+deb13u3.dsc
ca9cd0cde2b2d6371d5120dd74cfbf30f755875a3a084bfb466748ef56594e32 20724
xdg-dbus-proxy_0.1.6-1+deb13u3.debian.tar.xz
bd81c95c214be8a3c42f8e303c4df9edb58a0b6dc3dc4df405df79371f76cf6f 7943
xdg-dbus-proxy_0.1.6-1+deb13u3_source.buildinfo
Files:
ea3d428b78b291ef041d05b81b78c0e7 2232 admin optional
xdg-dbus-proxy_0.1.6-1+deb13u3.dsc
8748a0847cbaad3849be735856d73ec1 20724 admin optional
xdg-dbus-proxy_0.1.6-1+deb13u3.debian.tar.xz
8ab55748162f3d2ae0bd0e938ec2b102 7943 admin optional
xdg-dbus-proxy_0.1.6-1+deb13u3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmqz5zIACgkQI1wJnT6z
MHaEYA//ZB1nJgDdZweQ73k+fYZKXq4VbO2EguSfZbeOtEZpZR7ZSlbvZxdZCeNg
n1eAY8+IVfGWCXRM2B/38K1rJT/eF4gFflnM+mNOjyX0wZBNb5TukEVKaya+qLbz
waOuR+7ankH/DOj18A39S7bq2fl4j2dVgD4qSCkOiS42DxUIZDAXDoI+rURttbe9
VwPRWa/OxP4Pg5jAn/hPURYrA5KiUABvbUZ72ptcyRJOFG/ZBx6Oc83DLHzhrxbu
iNA5Jd/3eRqzCwJGTrttP8FGlA47FE3Jfs+ZbqCISd4Ur68al8vZ5o5jtL5GKeaD
pwrkoA7BIH6IcRfR6az88Y4Ev9It9qFnLwoa3vV5inLPo6+DgLvw+WJFA0oaHync
HiTWiGdOI8lYeltIpAcfiT5wYF2FA9iAfSLG6Abpw+fE2DgPkMztF6oRD+MC+9DV
6NjZgeg+WNZsqiRaNtBdl/sflgOLZK1fZQJDQ08rmRG+wx56pfZcqZtWVjnYGqC+
3MnyS/tmhoOBiuPYJf7eaeOeRlI4mQBfIdMDDp0F6Mnwwpzd+Q3nnuah8LlU3z+j
IHVPJMVUrLgLCgXgFG+3afhk7pNsMUFXzRvGyktSe+digWsDwPQubRWofXabOK/w
1B+f6vKmQ1SZVZJH2E2VrbLxlrxpVD37TsCjmFeJ3mzuqpeXlSY=
=sko/
-----END PGP SIGNATURE-----
pgpvYMhCbRQQz.pgp
Description: PGP signature
--- End Message ---
