UbuntuUpdates.org

Package "xdg-desktop-portal-dev"

Name: xdg-desktop-portal-dev

Description:

desktop integration portal - development files
Latest version: 1.21.1+ds-1ubuntu3.1
Release: resolute (26.04)
Level: security
Repository: universe
Head package: xdg-desktop-portal
Homepage: https://flatpak.github.io/xdg-desktop-portal/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "xdg-desktop-portal-dev"

All arch deb package
APT INSTALL

Other versions of "xdg-desktop-portal-dev" in Resolute

Repository Area Version
base universe 1.21.1+ds-1ubuntu3

Changelog

Version: 1.21.1+ds-1ubuntu3.1 2026-09-23 21:07:33 UTC

xdg-desktop-portal (1.21.1+ds-1ubuntu3.1) resolute-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2026-40354 (#2166546)
    - debian/patches/CVE-2026-40354-post1.patch: Get the fd of the file to
      trash on the host in src/trash.c
    - debian/patches/CVE-2026-40354-post2.patch: Check that the caller has
      write access on the fd to trash in src/trash.c
    - debian/patches/CVE-2026-40354-post3.patch: Never ignore the home trash
      location in src/trash.c
    - debian/patches/CVE-2026-40354-post4.patch: Add more debug logging in
      src/trash.c
    - debian/patches/CVE-2026-40354-post5.patch: Allow trash directories to
      have any mode in src/trash.c

 -- Kyle Kernick Tue, 22 Sep 2026 16:20:39 -0600
CVE-2026-40354 Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack o


About   -   Send Feedback to @ubuntu_updates