Opened 27 hours ago

Last modified 26 hours ago

#24006 new enhancement

xdg-dbus-proxy-0.1.9

Reported by: Joe Locash Owned by: SecurityAdvisory
Priority: elevated Milestone: 98-Security
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description 

Changes in 0.1.9
================

Released: 2026-09-23

  * Fix message filtering bypass vulnerabilities
    (CVE-2026-94422, GHSA-2cgv-pwcq-wvpq)
      - Don't allow method calls and signals to be treated as requested
        replies, even if they specify a reply serial number
      - Only allow replies that were sent to the appropriate destination
  * Improve automated tests to include attempts to exploit CVE-2026-94422

Change History (1)

comment:1 by Joe Locash, 26 hours ago

Milestone: 13.2 → 98-Security
Owner: changed from Joe Locash to SecurityAdvisory
Status: assigned → new

Fixed at 2ff1e9d791. Leaving open for SA.

Note: See TracTickets for help on using tickets.