Hi Nicholas,
On 05/11/2026 09:23, Nicholas Guriev wrote:
I have prepared and tested a security update for my package, telegram-
desktop. Unfortunately, my previous emails did not reach to the mailing
lisl, I guess due to an attached debdiff.
We do receive debdiffs correctly on this list, I don't know what happened.
CVE-2026-107181 is a one-click vulnerability that allows an attacker to
steal Telegram account or any secret file on victim's computer. I have
backported the one-liner patch from sid and tested the fix in bookworm
on the published exploit. It works with the 4.6.5+ds-2 revision and
doesn't with my 4.6.5+ds-2+deb12u1.
I have pushed the proposed change into the packaging repository on Salsa.
https://salsa.debian.org/debian/telegram-desktop/-/tags/
debian%2F4.6.5+ds-2+deb12u1
You can also view the difference between the current and the new revisions.
https://salsa.debian.org/debian/telegram-desktop/-/compare/
debian%2F4.6.5+ds-2...debian%2F4.6.5+ds-2+deb12u1?from_project_id=9409
Please review the change and sponsor my upload. As I recall, security-
master does not accept uploads from DM.
I have minor nitpicks (include the CVE ID in the changelog, explain why
there's no direct upstream patch) but this seems urgent enough so let's
upload this as it is on Salsa. I'm on it, it seems it'll take a while to
build.
Cheers!
Sylvain Beucler
Debian LTS Team
