-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 23 Sep 2026 13:16:29 +0100
Source: xdg-dbus-proxy
Architecture: source
Version: 0.1.6-1+deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Closes: 1148782
Changes:
 xdg-dbus-proxy (0.1.6-1+deb13u3) trixie-security; urgency=high
 .
   * d/p/CVE-2026-94422/*.patch:
     Apply patches from upstream release 0.1.9 to fix message filtering
     bypass vulnerabilities.
     A malicious or compromised Flatpak app could use these vulnerabilities
     to escape the sandbox and execute arbitrary code on the host.
     (CVE-2026-94422, GHSA-2cgv-pwcq-wvpq, Closes: #1148782)
   * Mention CVE-2026-93676, #1144129 in previous changelog entry
Checksums-Sha1:
 49ef3c4a3eecc3750cf058ded6cafd0d59cf7302 2232 xdg-dbus-proxy_0.1.6-1+deb13u3.dsc
 4c07aa2693bb12d6f5cb32b5e8693c98b53725e7 20724 xdg-dbus-proxy_0.1.6-1+deb13u3.debian.tar.xz
 f6dbc1a39474f6121bda0d872698158493b189da 7943 xdg-dbus-proxy_0.1.6-1+deb13u3_source.buildinfo
Checksums-Sha256:
 ab440e81165d397918024961c4b20ba58bb9e7d263554d1de8cbb54f9cd46b86 2232 xdg-dbus-proxy_0.1.6-1+deb13u3.dsc
 ca9cd0cde2b2d6371d5120dd74cfbf30f755875a3a084bfb466748ef56594e32 20724 xdg-dbus-proxy_0.1.6-1+deb13u3.debian.tar.xz
 bd81c95c214be8a3c42f8e303c4df9edb58a0b6dc3dc4df405df79371f76cf6f 7943 xdg-dbus-proxy_0.1.6-1+deb13u3_source.buildinfo
Files:
 ea3d428b78b291ef041d05b81b78c0e7 2232 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3.dsc
 8748a0847cbaad3849be735856d73ec1 20724 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3.debian.tar.xz
 8ab55748162f3d2ae0bd0e938ec2b102 7943 admin optional xdg-dbus-proxy_0.1.6-1+deb13u3_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmqz5zIACgkQI1wJnT6z
MHaEYA//ZB1nJgDdZweQ73k+fYZKXq4VbO2EguSfZbeOtEZpZR7ZSlbvZxdZCeNg
n1eAY8+IVfGWCXRM2B/38K1rJT/eF4gFflnM+mNOjyX0wZBNb5TukEVKaya+qLbz
waOuR+7ankH/DOj18A39S7bq2fl4j2dVgD4qSCkOiS42DxUIZDAXDoI+rURttbe9
VwPRWa/OxP4Pg5jAn/hPURYrA5KiUABvbUZ72ptcyRJOFG/ZBx6Oc83DLHzhrxbu
iNA5Jd/3eRqzCwJGTrttP8FGlA47FE3Jfs+ZbqCISd4Ur68al8vZ5o5jtL5GKeaD
pwrkoA7BIH6IcRfR6az88Y4Ev9It9qFnLwoa3vV5inLPo6+DgLvw+WJFA0oaHync
HiTWiGdOI8lYeltIpAcfiT5wYF2FA9iAfSLG6Abpw+fE2DgPkMztF6oRD+MC+9DV
6NjZgeg+WNZsqiRaNtBdl/sflgOLZK1fZQJDQ08rmRG+wx56pfZcqZtWVjnYGqC+
3MnyS/tmhoOBiuPYJf7eaeOeRlI4mQBfIdMDDp0F6Mnwwpzd+Q3nnuah8LlU3z+j
IHVPJMVUrLgLCgXgFG+3afhk7pNsMUFXzRvGyktSe+digWsDwPQubRWofXabOK/w
1B+f6vKmQ1SZVZJH2E2VrbLxlrxpVD37TsCjmFeJ3mzuqpeXlSY=
=sko/
-----END PGP SIGNATURE-----