Aller au contenu
en Se connecter
8.8 Élevée

CVE-2026-94422 An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass…

Description

An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.

Produits et versions touchés

Produit Versions touchées Corrigé en
Fedora 0.1 premières → < 0.1.9 0.1.9
Red Hat Enterprise Linux 9 Versions non publiées
Red Hat Enterprise Linux 10 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Fedora

Les 83 CVE de Fedora →
CVE-2026-19816 A flaw was found in PackageKit 7.1 Élevée CVE-2026-19624 A flaw was found in NetworkManager-l2tp 7.8 Élevée CVE-2023-4235 A flaw was found in ofono, an Open Source Telephony on Linux 8.1 Élevée CVE-2023-4234 A flaw was found in ofono, an Open Source Telephony on Linux 8.1 Élevée
Suivre cette CVE