Dear LTS Team,
I have prepared and tested a security update for my package,
telegram-desktop. Unfortunately, my previous emails did not reach to
the mailing lisl, I guess due to an attached debdiff.
CVE-2026-107181 is a one-click vulnerability that allows an attacker to
steal Telegram account or any secret file on victim's computer. I have
backported the one-liner patch from sid and tested the fix in bookworm
on the published exploit. It works with the 4.6.5+ds-2 revision and
doesn't with my 4.6.5+ds-2+deb12u1.
I have pushed the proposed change into the packaging repository on
Salsa.
https://salsa.debian.org/debian/telegram-desktop/-/tags/debian%2F4.6.5+ds-2+deb12u1
You can also view the difference between the current and the new
revisions.
https://salsa.debian.org/debian/telegram-desktop/-/compare/debian%2F4.6.5+ds-2...debian%2F4.6.5+ds-2+deb12u1?from_project_id=9409
Please review the change and sponsor my upload. As I recall,
security-master does not accept uploads from DM.
