-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 23 Oct 2026 19:53:35 -0500 Source: xdg-dbus-proxy Architecture: source Version: 0.1.4-3+deb12u2 Distribution: bookworm-security Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Simon Quigley <tsimonq2@debian.org> Changes: xdg-dbus-proxy (0.1.4-3+deb12u2) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * CVE-2026-94422: only a method return or an error counts as a reply. * CVE-2026-94422: name which side each message is travelling toward. * CVE-2026-94422: only accept a reply going back to the original caller. * Add basic reply coverage from 4427d5d0eb6d on the existing test. * Reject a method call or signal that only quotes a reply serial. * Reject a reply that is aimed at a different peer. Checksums-Sha1: 8a9f8cc4060cf54691c9032025c72b6c63b55409 2233 xdg-dbus-proxy_0.1.4-3+deb12u2.dsc 2b23418e73c5b973259be7b155d2fd2c4736f9f6 15276 xdg-dbus-proxy_0.1.4-3+deb12u2.debian.tar.xz 4cf51237701c222d0897613c34853fd76cf21756 7332 xdg-dbus-proxy_0.1.4-3+deb12u2_source.buildinfo Checksums-Sha256: 2d3b37dea4932031d6b2b1f87c5c1f326a3a34da4550e026d7d865c366b8c7c1 2233 xdg-dbus-proxy_0.1.4-3+deb12u2.dsc ae902ec81b99ab88e9545160b8a3f20dde7e07ebb9587c8621efb75cf8ebb7d9 15276 xdg-dbus-proxy_0.1.4-3+deb12u2.debian.tar.xz fd3661be966e40ba3e73d6d47c69c931bbd5d947ce45cc90ae428819a1b0d280 7332 xdg-dbus-proxy_0.1.4-3+deb12u2_source.buildinfo Files: ed4bb4c81a36ecacaec94b08003919f9 2233 admin optional xdg-dbus-proxy_0.1.4-3+deb12u2.dsc 0f9aff0c26598bcef751e8df7bbbcaaf 15276 admin optional xdg-dbus-proxy_0.1.4-3+deb12u2.debian.tar.xz 60dc7b36920fff8759fac15322b8437b 7332 admin optional xdg-dbus-proxy_0.1.4-3+deb12u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrcAdwACgkQ4n8s+EWM L6SdWw/+I/iQ90q3LIAxMCU5+haPcdklttKZUK2KAwJ2IXW66wtAZ3v2Q9c3v/qA 5EE8I39ff3kXrHJq85JhbhESFlf+F0vmJSTu/X+BoMSZXK8FjHfqocItRE/V5Fc5 WLtNrAZtBEkg8nBW0G8nH4FIekHVyTFR22y6TUGbmbNuL7Sn/MmUjg3adYarq6iY Zw+qjKADKpK1N2rqV0Q+EDC5EDESHJz4kbxMhk9NLk3QOLdPxpzUpsiUBRghs3ty 0PXEG3Pog/41c+BCbMoQQfhPPTUF5B4VTm+ok2W2J5zEZu3y0cOCeUFm0ZWJvUqX d6/xYxbBR+fx6nstz7p12Wi6efqxDXCMgDzKt9EnMjBExWITtm1nXp/sYDTvCDZA 3CXI576j+3a6pRpJyskGxuprKYCKkApL5lLJ6auNO+rx7BULSJKhG0vQCSdGsZHY aK7C6QyoAAAaG9pHNADWI0T51UgEoGj/E5U3XVLk3T3ozeXbmoci20OIZXr6EOWm 4vgNxsQp2UuRM5qoOrSsqp04I8bDmA3QHDPGl9Ywl2KSy9R0p1lOi/y6JouKqEET PI+r90D/kdzh9HksShgoQlXJm868+YTj4jt1TkCqX4IC7RD/MMpKKscV9fyLGbIE tDWLPXjPUpnicMe1WU+gkAaONUHAv4/uPwB+xlRvCzBjAv7LowM= =V5Ty -----END PGP SIGNATURE-----
