Package "xdg-desktop-portal"

xdg-desktop-portal (1.18.4-1ubuntu2.24.04.3) noble-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2026-40354 (#2166546)
    - debian/patches/CVE-2026-40354-post1.patch: Get the fd of the file to
      trash on the host in src/trash.c
    - debian/patches/CVE-2026-40354-post2.patch: Check that the caller has
      write access on the fd to trash in src/trash.c
    - debian/patches/CVE-2026-40354-post3.patch: Never ignore the home trash
      location in src/trash.c
    - debian/patches/CVE-2026-40354-post4.patch: Add more debug logging in
      src/trash.c
    - debian/patches/CVE-2026-40354-post5.patch: Allow trash directories to
      have any mode in src/trash.c

 -- Kyle Kernick Tue, 22 Sep 2026 09:20:10 -0600

  xdg-desktop-portal (1.18.4-1ubuntu2.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: Symlink Redirection Attack in g_file_trash
    - debian/patches/CVE-2026-40354-pre1.patch: Add libglnx dependency in
      meson.build and subprojects/libglnx.wrap
    - debian/patches/CVE-2026-40354-pre2.patch: use Call over Requests in
      src/gamemode.c,
      ../memory-monitor.c,
      ../network-monitor.c,
      ../proxy-resolver.c,
      ../realtime.c,
      ../trash.c, and
      ../xdg-desktop-portal.c
    - debian/patches/CVE-2026-40354-1.patch: Use File Descriptors rather than
      g_file_trash to avoid race conditions when trashing file in src/trash.c
    - debian/patches/CVE-2026-40354-2.patch: Fix trashing files on older
      versions of glib in src/trash.c
    - CVE-2026-40354
  * xdg-desktop-portal_1.18.4.orig-libglnx.tar.gz: Add vendored libglnx
    at ccea836b799256420788c463a638ded0636b1632.
  * debian/rules: Add symlink to vendored libglnx in submodules/libglnx
  * debian/clean: Remove vendored libglnx symlink after build

 -- Kyle Kernick <email address hidden> Thu, 23 Apr 2026 15:56:27 -0600