[ubuntu/resolute-security] xdg-desktop-portal 1.21.1+ds-1ubuntu3.1 (Accepted)

[Kyle Kernick]

xdg-desktop-portal (1.21.1+ds-1ubuntu3.1) resolute-security; urgency=medium

  * SECURITY REGRESSION: Incomplete fix for CVE-2026-40354 (#2166546)
    - debian/patches/CVE-2026-40354-post1.patch: Get the fd of the file to
      trash on the host in src/trash.c
    - debian/patches/CVE-2026-40354-post2.patch: Check that the caller has
      write access on the fd to trash in src/trash.c
    - debian/patches/CVE-2026-40354-post3.patch: Never ignore the home trash
      location in src/trash.c
    - debian/patches/CVE-2026-40354-post4.patch: Add more debug logging in
      src/trash.c
    - debian/patches/CVE-2026-40354-post5.patch: Allow trash directories to
      have any mode in src/trash.c

Date: 2026-09-22 22:38:23.742073+00:00
Changed-By: Kyle Kernick <kyle.kernick at canonical.com>
https://launchpad.net/ubuntu/+source/xdg-desktop-portal/1.21.1+ds-1ubuntu3.1
-------------- next part --------------
Sorry, changesfile not available.