Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail. Impact: A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox. If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated. Fixed in 0.1.9 by commits: * e5702fca4dba9600721921fbca2dbc39dc5ca400 "proxy: Don't assume that only returns and errors have a reply-serial" * fc027f759316fb2a6c45648200b6f100202eb84e "proxy: Make it clearer which direction messages are going in" * e4465a0dfe96da3b39929a30a1ac3a22b16223e3 "proxy: Only allow replies to go to the correct destination" Reported by @refi64. Reference: https://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-2cgv-pwcq-wvpq
FEDORA-2026-f10257ca80 (xdg-dbus-proxy-0.1.9-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-f10257ca80
FEDORA-2026-93f562a43f (xdg-dbus-proxy-0.1.9-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-93f562a43f
FEDORA-2026-e1cac11588 (xdg-dbus-proxy-0.1.9-1.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-e1cac11588
FEDORA-2026-f10257ca80 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-f10257ca80` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-f10257ca80 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-e1cac11588 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-e1cac11588` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-e1cac11588 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-93f562a43f has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-93f562a43f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-93f562a43f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-93f562a43f (xdg-dbus-proxy-0.1.9-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-f10257ca80 (xdg-dbus-proxy-0.1.9-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-e1cac11588 (xdg-dbus-proxy-0.1.9-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.