Opened 3 weeks ago

Closed 3 weeks ago

#24006 closed enhancement (fixed)

xdg-dbus-proxy-0.1.9

Reported by: Joe Locash Owned by: SecurityAdvisory
Priority: elevated Milestone: 98-Security
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description 

Changes in 0.1.9
================

Released: 2026-09-23

  * Fix message filtering bypass vulnerabilities
    (CVE-2026-94422, GHSA-2cgv-pwcq-wvpq)
      - Don't allow method calls and signals to be treated as requested
        replies, even if they specify a reply serial number
      - Only allow replies that were sent to the appropriate destination
  * Improve automated tests to include attempts to exploit CVE-2026-94422

Change History (2)

comment:1 by Joe Locash, 3 weeks ago

Milestone: 13.2 → 98-Security
Owner: changed from Joe Locash to SecurityAdvisory
Status: assigned → new

Fixed at 2ff1e9d791. Leaving open for SA.

comment:2 by Bruce Dubbs, 3 weeks ago

Resolution: → fixed
Status: new → closed

Advisory sa-13.1-037 has been issued.

Note: See TracTickets for help on using tickets.