-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 23 Sep 2026 13:16:29 +0100
Source: xdg-dbus-proxy
Binary: xdg-dbus-proxy xdg-dbus-proxy-dbgsym xdg-dbus-proxy-tests xdg-dbus-proxy-tests-dbgsym
Architecture: arm64
Version: 0.1.6-1+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: arm64 Build Daemon (arm-conova-03) <buildd_arm64-arm-conova-03@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 xdg-dbus-proxy - filtering D-Bus proxy
 xdg-dbus-proxy-tests - filtering D-Bus proxy - as-installed tests
Closes: 1148782
Changes:
 xdg-dbus-proxy (0.1.6-1+deb13u3) trixie-security; urgency=high
 .
   * d/p/CVE-2026-94422/*.patch:
     Apply patches from upstream release 0.1.9 to fix message filtering
     bypass vulnerabilities.
     A malicious or compromised Flatpak app could use these vulnerabilities
     to escape the sandbox and execute arbitrary code on the host.
     (CVE-2026-94422, GHSA-2cgv-pwcq-wvpq, Closes: #1148782)
   * Mention CVE-2026-93676, #1144129 in previous changelog entry
Checksums-Sha1:
 f54d99fa05d24457aa20daa5ccaf81a59fbffe12 69936 xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_arm64.deb
 814c46e5861001ba66b4edaa024c98fa9718ae37 26688 xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_arm64.deb
 dc2d960fd8553ddbd96f69a31ded88e35397913c 14340 xdg-dbus-proxy-tests_0.1.6-1+deb13u3_arm64.deb
 8b43a0530fdff1279ae6215ac3eed9a60dcc89c7 8971 xdg-dbus-proxy_0.1.6-1+deb13u3_arm64-buildd.buildinfo
 01a512a52adcc970bfab946bc7f3a46a9d23b2d1 25060 xdg-dbus-proxy_0.1.6-1+deb13u3_arm64.deb
Checksums-Sha256:
 f2205b5d5cbef48f8a6574053c984908d3709d9515e5a43ac7315b93432b91b4 69936 xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_arm64.deb
 ec73b28e044a3bed23d11772b2e5955be1d134de6ecd265d00701916d78b0776 26688 xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_arm64.deb
 513cb3b60f921bc6b85a4d714faf5251a00c2cc7ec989d22e30131eadf8df95d 14340 xdg-dbus-proxy-tests_0.1.6-1+deb13u3_arm64.deb
 ca8f8a37913558002d8fbe3ccd450d84ef512fd667e49299ea860b021dddd044 8971 xdg-dbus-proxy_0.1.6-1+deb13u3_arm64-buildd.buildinfo
 e6034618ff5c4beed8426939db1d3fa92ac68ab4599d6421d8421ca4a6044b24 25060 xdg-dbus-proxy_0.1.6-1+deb13u3_arm64.deb
Files:
 9b9bfdeacdedaf4fd6cdcc9ab08d992c 69936 debug optional xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_arm64.deb
 da8e3016ba685b9905638354050c73ed 26688 debug optional xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_arm64.deb
 d18b14dc20bf2ec033f4da4d0b33d736 14340 admin optional xdg-dbus-proxy-tests_0.1.6-1+deb13u3_arm64.deb
 a820446fa935c0fe2fe7b6269ae30713 8971 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_arm64-buildd.buildinfo
 872ea3506b30849df9222f72f5e691f4 25060 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmqz7acACgkQXVp1sEH/
1mLUWg/9EGjFnmfIT+xJfZ+0HDtF+mVyNC5UlEnlxQ0tndyBg49yw+1A4LROHdiF
Pye/dunFAD1ut5aN4XqHO/9BhhTe7JyrQV+1AhZWe0ZvmDLMcexJ4vk1qVQF079C
hI5YuV0wtO2jLI3fwKZXvxlMFRCM/qGPWMxuJC2MIhYsC5mzRdS3pAEnrEF+6OZM
73Ehh34dZwRhcfjCU/AZrJk0sgc9PMZw6p4E4TMbxxtEPJQLZG5lCK+9K/lEgTMC
/gdu9qSoFCOB3pPb1LYhXsRCk3miqVutRfNovaxyAgpG6PITaenxOyLQiJ4tAS07
0AtIE/GyuSjcJv0Ue+hu9g2ycef68+IkY4sXAWWKmmwYgaG8eM7Iy0qKGQEFISk5
YUGaFVQ1TKyTN6ofmtq95ED+pq+PK6DRr/A/Rke4RhaA3D2uwxbkb+KjoyFnySXr
5vRKsp3NZ8LplmGD3RAYT0eNOixGVgl2Uv34NN8a9XqzNi6Z+oKjWt2Mv6Zq/MZd
s9qY5k/f3hMMXLpintwp6tB9sn4KFfSsdbKHUB/7kaPFGt19JbZaIwJ4OnFXZkxF
8TkZPsITnbrSOe0C2+bf+BCsiwODShOYFxHmgAIYCsB7etTqppW/CQLTq3V5W4Je
317XC9O1QIp7Iv1WT9tMpcp7j3VO3lCeVdqV8oeg7OopY15GaJg=
=s+PI
-----END PGP SIGNATURE-----