Your message dated Sat, 12 Sep 2026 08:05:42 +0000
with message-id <[email protected]>
and subject line Released in 13.7
has caused the Debian Bug report #1146546,
regarding trixie-pu: package transmission/4.1.0~beta2+dfsg-3+deb13u2
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146546: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146546
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:transmission
User: [email protected]
Usertags: pu
Fixes a minor security issue, debdiff below. All tests were fine.
Cheers,
Moritz
diff -Nru transmission-4.1.0~beta2+dfsg/debian/changelog
transmission-4.1.0~beta2+dfsg/debian/changelog
--- transmission-4.1.0~beta2+dfsg/debian/changelog 2025-08-23
18:17:20.000000000 +0200
+++ transmission-4.1.0~beta2+dfsg/debian/changelog 2026-09-01
00:05:34.000000000 +0200
@@ -1,3 +1,9 @@
+transmission (4.1.0~beta2+dfsg-3+deb13u2) trixie; urgency=medium
+
+ * CVE-2026-38978
+
+ -- Moritz Mühlenhoff <[email protected]> Tue, 01 Sep 2026 00:05:34 +0200
+
transmission (4.1.0~beta2+dfsg-3+deb13u1) trixie; urgency=medium
* fix GTK app crash when LANG=fr (Closes: #1108194, #1110257)
diff -Nru transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
--- transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
1970-01-01 01:00:00.000000000 +0100
+++ transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
2026-09-01 00:05:34.000000000 +0200
@@ -0,0 +1,33 @@
+From e51d77e202206ee1389cbd6d9ab154421942b530 Mon Sep 17 00:00:00 2001
+From: Charles Kerr <[email protected]>
+Date: Tue, 31 Mar 2026 09:13:32 -0500
+Subject: [PATCH] fix: add clickjack safeguards when serving http responses
+ (#8747) (#8749)
+
+--- transmission-4.1.0~beta2+dfsg.orig/libtransmission/rpc-server.cc
++++ transmission-4.1.0~beta2+dfsg/libtransmission/rpc-server.cc
+@@ -175,7 +175,15 @@ namespace
+ {
+ int constexpr DeflateLevel = 6; // medium / default
+
+-// ---
++// Prevent clickjacking on the browser-facing WebUI and RPC responses.
++// https://github.com/transmission/transmission/issues/8726
++//
https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html.
++void add_clickjacking_prevention_headers(struct evkeyvalq* headers)
++{
++ // Send X-Frame-Options for older browsers + CSP frame-ancestors for
newer ones
++ evhttp_add_header(headers, "X-Frame-Options", "SAMEORIGIN");
++ evhttp_add_header(headers, "Content-Security-Policy", "frame-ancestors
'self'");
++}
+
+ void send_simple_response(struct evhttp_request* req, int code, char const*
text = nullptr)
+ {
+@@ -499,6 +507,7 @@ void handle_request(struct evhttp_reques
+
+ auto* const output_headers = evhttp_request_get_output_headers(req);
+ evhttp_add_header(output_headers, "Server", MY_REALM);
++ add_clickjacking_prevention_headers(output_headers);
+
+ if (server->is_anti_brute_force_enabled() && server->login_attempts_ >=
server->settings().anti_brute_force_limit)
+ {
diff -Nru transmission-4.1.0~beta2+dfsg/debian/patches/series
transmission-4.1.0~beta2+dfsg/debian/patches/series
--- transmission-4.1.0~beta2+dfsg/debian/patches/series 2025-08-20
11:41:32.000000000 +0200
+++ transmission-4.1.0~beta2+dfsg/debian/patches/series 2026-09-01
00:05:34.000000000 +0200
@@ -5,3 +5,4 @@
web-easier-build.patch
0003-disable-git-hook-installation.patch
0004-do-not-mess-revision.patch
+CVE-2026-38978.patch
--- End Message ---
--- Begin Message ---
Version: 13.7
This update was released as part of 13.7.
--- End Message ---
