-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 23 Sep 2026 13:16:29 +0100
Source: xdg-dbus-proxy
Binary: xdg-dbus-proxy xdg-dbus-proxy-dbgsym xdg-dbus-proxy-tests xdg-dbus-proxy-tests-dbgsym
Architecture: armhf
Version: 0.1.6-1+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: armhf Build Daemon (arm-ubc-05) <buildd_arm64-arm-ubc-05@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 xdg-dbus-proxy - filtering D-Bus proxy
 xdg-dbus-proxy-tests - filtering D-Bus proxy - as-installed tests
Closes: 1148782
Changes:
 xdg-dbus-proxy (0.1.6-1+deb13u3) trixie-security; urgency=high
 .
   * d/p/CVE-2026-94422/*.patch:
     Apply patches from upstream release 0.1.9 to fix message filtering
     bypass vulnerabilities.
     A malicious or compromised Flatpak app could use these vulnerabilities
     to escape the sandbox and execute arbitrary code on the host.
     (CVE-2026-94422, GHSA-2cgv-pwcq-wvpq, Closes: #1148782)
   * Mention CVE-2026-93676, #1144129 in previous changelog entry
Checksums-Sha1:
 fccbca833e7bfdcbbcfc9ac7e2ba663c2285aa22 69032 xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_armhf.deb
 98f65a8b20384cefc4a705797a7906c511248f2e 25972 xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_armhf.deb
 dde97af487fc9344c9ac3f8a95ddb82c6762fc69 14628 xdg-dbus-proxy-tests_0.1.6-1+deb13u3_armhf.deb
 1e324a48e92a149cd66e6454f190970cf98d8bc8 8850 xdg-dbus-proxy_0.1.6-1+deb13u3_armhf-buildd.buildinfo
 5217a9934f040abf8aa081fd744e2cb1621b0848 23176 xdg-dbus-proxy_0.1.6-1+deb13u3_armhf.deb
Checksums-Sha256:
 cf8dac4b5bb05ada59b9e6f60575502045e3b0a015f7f4e6c6cff9b9fb64b73b 69032 xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_armhf.deb
 9a9c1b0ded11a5fe606fc34661c29cc4edef74bdbaa1a284e1777ce9ff11eebd 25972 xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_armhf.deb
 b2657a70b413f886b07953c1db1d2a9d9551482676458c083ead9b0753fb3b7c 14628 xdg-dbus-proxy-tests_0.1.6-1+deb13u3_armhf.deb
 58c00e1735a7719c784cfdffe6add8a15bddbc84976bb9a9720517973d757a73 8850 xdg-dbus-proxy_0.1.6-1+deb13u3_armhf-buildd.buildinfo
 e83aac138a5ad762f580b8b5e4284cc2420bd634a61977b72aa72cc83ec66663 23176 xdg-dbus-proxy_0.1.6-1+deb13u3_armhf.deb
Files:
 87f185e6fe3a42a8d817fb42caae94ae 69032 debug optional xdg-dbus-proxy-dbgsym_0.1.6-1+deb13u3_armhf.deb
 6029186fac386bed6c8eedcb68d70a93 25972 debug optional xdg-dbus-proxy-tests-dbgsym_0.1.6-1+deb13u3_armhf.deb
 961cfa1464fa3441c71a4d9b484888ba 14628 admin optional xdg-dbus-proxy-tests_0.1.6-1+deb13u3_armhf.deb
 90b4bb603b6b5c1523faea794a46a64b 8850 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_armhf-buildd.buildinfo
 98809a7fc1845395c2072e337ec8c3f8 23176 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7rv+l3KtZdQea77lnwznazfjXToFAmqz7ZkACgkQnwznazfj
XTrdwg//SzcA+T0UPLnRYYpotFjuVCX28K8/IMTzaWegjBR9R1Tbb+P8kRQZPhp4
jzh0w0+2Zv+x2IXXiNimWMOsZqBD2+1yKMzQBLB9yypX+ujBq9k9I7QYjJow/pev
b81rs0MFrVgWA/i97Kw6irTrECaZP2xcaCNnQrPClZPR+Ep9ZelILcvxXhwa53qe
I8IfBuM4f9GBjRwkXUHBAnhcLC+Op/1/ilPR2dPLt50T0DLGhZsvZhZIOJ6X8Xh4
wmv6u2rTfld1Zt8DzR4kHyLNwHmxZMRri/gU+PdZjJiau4MqarD7Hzt4RLbEipTx
E4zHQXlGBXFnPaHW4eHRM1q0Nnxg9oScAO6yMBB6eDGJQecnRzwFruweKYwVDi6i
f5yw3aDZtOhmv5kSBL7zaP32r+XT9Qw4x3Jz2RpxxBUMreGB9VwkomH0XCEioL73
FULLDl2t5hha8asY6bWRjfpXVp11HG+PSxd2mZLCYnEfzGKb9+ZJtIIYjrZApBSm
ep5Z97A87sebbOoTqf/L0PVA6evvOWzy3h+FA8nBpwxgeNLQ4GlC86ISgWHH+D6r
iXKvIt8XBQu5sGLI0/nyLBDguDsBWJEtEAV2vaswBMJLy7axbSOmJ/J2UyDFmTB9
vruy2Jel3aDaKhh9U+pbNDu4uHjxYiF9oma+9houtHkQntkYUnI=
=7d63
-----END PGP SIGNATURE-----