[<prev] [next>] [day] [month] [year] [list]
Message-ID: <admGQUalTr1TtMJt@definition.pseudorandom.co.uk>
Date: Sat, 11 Apr 2026 00:22:41 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: xdg-dbus-proxy CVE-2026-34080: Eavesdrop filter
bypass allows message interception
https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-vjp5-hjfm-7677
Codean Labs reported that a D-Bus match rule parsing bug in
xdg-dbus-proxy allows bypassing the proxy's eavesdropping restrictions.
In practice xdg-dbus-proxy is mainly used by Flatpak, so a typical
attacker would be a malicious or compromised Flatpak app.
The impact is that clients can read D-Bus messages on the session bus
that they should not have had access to. This is fixed in xdg-dbus-proxy
0.1.7.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
