-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 11 Aug 2026 13:43:30 +0100
Source: xdg-dbus-proxy
Architecture: source
Version: 0.1.6-1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Changes:
 xdg-dbus-proxy (0.1.6-1+deb13u2) trixie-security; urgency=high
 .
   * d/p/GHSA-r7hp-698j-2h6c/*.patch:
     Fix a vulnerability in access control for receiving broadcasts.
     In 0.1.6 and 0.1.7, a malicious or compromised Flatpak app could
     receive any broadcast D-Bus message on the session bus or the AT-SPI
     bus, leading to unintended information disclosure.
   * d/p/tests/*.patch:
     Add automated test coverage for message filtering
Checksums-Sha1:
 1bdb0dba2ae46ad8fa0746524ece89e0cf2e9a49 2232 xdg-dbus-proxy_0.1.6-1+deb13u2.dsc
 d88efeb7f219417e545e545e58c7ff3828bc1e28 13136 xdg-dbus-proxy_0.1.6-1+deb13u2.debian.tar.xz
 902ee335cacb26eb6ff1c3a830e9b5e1b87fceb2 7779 xdg-dbus-proxy_0.1.6-1+deb13u2_source.buildinfo
Checksums-Sha256:
 58d393bc3710dc60b87c68fa9b4616771323713993c0d51ddd0c021b3ebdb4ca 2232 xdg-dbus-proxy_0.1.6-1+deb13u2.dsc
 bb5a6e8e997a022fda2efaaebf770a784cb30571d572df4945882bb747f9fca8 13136 xdg-dbus-proxy_0.1.6-1+deb13u2.debian.tar.xz
 43361f600cfe75a53097ab52153fc8ebfcc9dac5d1cc235080922e0dec1270d3 7779 xdg-dbus-proxy_0.1.6-1+deb13u2_source.buildinfo
Files:
 047e06c38374d23d63eb8cd78f87c9be 2232 admin optional xdg-dbus-proxy_0.1.6-1+deb13u2.dsc
 a6487c6623de5d900ea4bffb2053d518 13136 admin optional xdg-dbus-proxy_0.1.6-1+deb13u2.debian.tar.xz
 4b82b2b97ebb9e5923c1631eb047e176 7779 admin optional xdg-dbus-proxy_0.1.6-1+deb13u2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmp7OU4ACgkQI1wJnT6z
MHbbiw/9H/Q9IPeOOozcc+IK4jYaIiWDqnRKz+v5yN/SaB8/rkiIIMQ/KBpcChTX
4iYO+AZQHbYTHb0SkTY9Cbm5trqShQ/KavuZo3gRlJAcJxVGwp/0llWPzWyimp7b
BtuO7rrBp2cxNJ0Au9jqiAlmxt6MIqOECZ635RFvBPqpjKIXIf2g3iI1a2QrweYO
Aktu/yzgKc62a63H0f8G6Q5pLGB4rH/CYVRdyWG7xcCmviN6n0JbIDHeXw/ehZWA
O2SwMYhe7izi2MNCYN2qdAIwPqZ0O54KY05moL4+MwN0B9DrE5IAzv+kRjCUK4ZT
64kugpEZSY/DpQUdVl6VgK+pSDiD82tW6GzSI5SeBJCDKZZuZpUaptOfp1Ua2CyL
T2sL1wLO1kYhPkPqQzMKhMWb/fGXw0uHVUDhjnPsmthJLCRS0luuRBaJCbKLQkWm
DB4iw9NlGDRk8O+Ynv2N+n6lXD90EIHJCWEGtuCnoPH6zxyXui2GNhQpnJ1bBXKE
/LqBR1+/D4jyxgKyY7JJ/Gl1MVkXYFVdB8Ya9YCUwmG/L5f/ZkPptTtGcwg7rJCB
ae7queD+5s99EftGBuJW/HgHPIiiqeTNr/fu0EPCnoac8UoTz0XcJrGxUI9cAebU
pyxuwaVjOUVEM5qRWfigCAbKEtJ0BEMkC6Hc465jxjHL3RKHm4E=
=BcSF
-----END PGP SIGNATURE-----