Your message dated Wed, 23 Sep 2026 14:48:55 +0000
with message-id <[email protected]>
and subject line Bug#1148782: fixed in xdg-dbus-proxy 0.1.9-1
has caused the Debian Bug report #1148782,
regarding xdg-dbus-proxy: CVE-2026-94422: Message filtering bypass via reply
serial (GHSA-2cgv-pwcq-wvpq)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148782: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148782
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: xdg-dbus-proxy
Version: 0.1.0-1
Severity: grave
Tags: security
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <[email protected]>
https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
>An incorrect implementation of message filtering in xdg-dbus-proxy
>versions before 0.1.9 allows an attacker to bypass the intended message
>filtering on the D-Bus session bus by setting a reply serial number on
>non-reply messages.
>
>xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak,
>but it is released as a separate project and is sometimes used by other
>app frameworks such as Firejail.
>
>Impact:
>
>A malicious or compromised Flatpak app could achieve arbitrary code
>execution outside its sandbox.
>
>If other app frameworks rely on xdg-dbus-proxy in the same way that
>Flatpak does, then they will have an equivalent vulnerability until
>xdg-dbus-proxy is updated.
>
>Workarounds:
>
>Avoid running untrusted Flatpak apps.
>
>Avoid running untrusted apps via other frameworks that use xdg-dbus-proxy.
--- End Message ---
--- Begin Message ---
Source: xdg-dbus-proxy
Source-Version: 0.1.9-1
Done: Simon McVittie <[email protected]>
We believe that the bug you reported is fixed in the latest version of
xdg-dbus-proxy, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Simon McVittie <[email protected]> (supplier of updated xdg-dbus-proxy package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 23 Sep 2026 15:07:42 +0100
Source: xdg-dbus-proxy
Architecture: source
Version: 0.1.9-1
Distribution: unstable
Urgency: high
Maintainer: Utopia Maintenance Team
<[email protected]>
Changed-By: Simon McVittie <[email protected]>
Closes: 1148782
Changes:
xdg-dbus-proxy (0.1.9-1) unstable; urgency=high
.
* New upstream release
- Fix message filtering bypass vulnerabilities
(CVE-2026-94422, GHSA-2cgv-pwcq-wvpq, Closes: #1148782)
* Mention CVE-2026-93676 in previous changelog entry
* d/patches/series: Remove empty patch series
Checksums-Sha1:
32cc44c2caf63c3eec67a869c791d486c1b83786 2489 xdg-dbus-proxy_0.1.9-1.dsc
ff6c4973cb7037b4bbb0004cc342f9fc762c0831 48716 xdg-dbus-proxy_0.1.9.orig.tar.xz
780d27e8a0a1733605ce07d6eb8dfc56fe7e3268 4456
xdg-dbus-proxy_0.1.9-1.debian.tar.xz
3cbfbb9e1efaecb31b6e4c3b0283df470d22556b 119720
xdg-dbus-proxy_0.1.9-1.git.tar.xz
4a89f3cc3db65e48f245cc729b816ed9615c4bc3 17750
xdg-dbus-proxy_0.1.9-1_source.buildinfo
Checksums-Sha256:
cd6cdb54e1eceb8ff7bfe11da53c83eb2a83662deb3e82d1c65355cbed74f264 2489
xdg-dbus-proxy_0.1.9-1.dsc
5450dda586ec3bb3ca709d311e845487883faa3b09cf562608d7e84f4311dced 48716
xdg-dbus-proxy_0.1.9.orig.tar.xz
6f4945c422ef35ff2c504c3963bfb79a6effc086657f0c87e46987f7ca7354d3 4456
xdg-dbus-proxy_0.1.9-1.debian.tar.xz
bc228dcaf0025731100fc249cdf3640c6353ccb24cf1fafb9a9b105223cd7ce7 119720
xdg-dbus-proxy_0.1.9-1.git.tar.xz
6a220d7bcdb7296b356b31af506eef12cc9fdde4a805af4c6209de5907c4d457 17750
xdg-dbus-proxy_0.1.9-1_source.buildinfo
Files:
c78c0d3cc41d1af57d60468259cb064e 2489 admin optional xdg-dbus-proxy_0.1.9-1.dsc
ce99fa3fe140e817d70be0fd45b3a2a3 48716 admin optional
xdg-dbus-proxy_0.1.9.orig.tar.xz
76f33b9c87bf2db44200dc85b9db6c7b 4456 admin optional
xdg-dbus-proxy_0.1.9-1.debian.tar.xz
0fe09ef94e2d844bdb66161532fb5c1b 119720 admin optional
xdg-dbus-proxy_0.1.9-1.git.tar.xz
b7510b089579eb820a68c0e2e065db63 17750 admin optional
xdg-dbus-proxy_0.1.9-1_source.buildinfo
Git-Tag-Info: tag=a154a86755ca45c00b38c53194f13d4f72bd74c7
fp=7a073ad1ae694fa25bff62e5235c099d3eb33076
Git-Tag-Tagger: Simon McVittie <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqz4l8ACgkQYG0ITkaD
wHnyzxAA1RvPym3J7k2UNY0vmmnUBxgqQcXulaB7YZB6HQUGW8hLgkVCV0NYrt7X
810S58KRAWfuO/RqPZET4Jie8avXVk1IvG8lVuUjUMnCvqj9OIuotm8vXJvVjOqm
ZZiyAd8OlF1W4oQ2+dg058QiPw11vCQljm/YEMhlYHcsrrU2yrJ3QFEFRuAutYgL
cqhKgmf+bce1+du1DV8NMNAPtICL1Im49y5JX25IzWUc6wUQMdC8c+yByP1Y9oYw
iiWYcKw5FCCiwOoBq0udAegEVJwqAjEU/ZSPcKRltyNknVfRxLZIOqpUBDK75m3s
yKgf96ucs8x1ehQ4masf/rt/QqtKUabZa2xoITdXqQSyy0zz1wX8MhR/ktpanlzG
znekQVaardZ1PmudeFNte8O/u+C9xbk17DaD6svbo+qdj7OgKYdoNtOQeK05gSc9
v/1dvg6h0yHi+se7dbTnFly/Fug2ygIojLZdj1TEBHd+mMPgF+NMUkc+xNJliB3n
JWA7MUPqBSkCX2E+6CHL2YnQ1lLMvS3myJQ7ymiwfq91zCp4lHIY6SzF5+eM8fKh
25xbrWvqIuFDoty85j9Gzro/n8Wft+SwI1QGCIXYF4JYMku9E2sIRTF7axtwJJNE
9fSrkbgi8mXHEDrdSVYfzmJee7Nc4gtxLqWl0jtywWwHGon2eNU=
=kyaz
-----END PGP SIGNATURE-----
pgpXUIRjXFZPx.pgp
Description: PGP signature
--- End Message ---
