BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT
← Lifecycle catalogue
DEBIAN SECURITY ADVISORYDEBIANVERIFIED

PUBLISHER UPDATE · DSA-6510-1

DSA-6510-1 release notes and known issues

DSA-6510-1 xdg-dbus-proxy - security update

Scope: Debian. This update record adds version, fix and known-issue context. Its publication date is not a lifecycle boundary.

Summary

It was discovered that an incorrect implementation of message filtering in xdg-dbus-proxy allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox. If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated. https://security-tracker.debian.org/tracker/DSA-6510-1

Improvements and security content

  • It was discovered that an incorrect implementation of message filtering in xdg-dbus-proxy allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox. If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated. https://security-tracker.debian.org/tracker/DSA-6510-1

Known issues

Publisher statement

Not stated. The verified publisher record does not contain a known-issues statement.

Affected products and versions

Products

  • Debian

Affected versions

  • See the official publisher source for applicability.

Fixed versions or updates

  • No fixed version is stated in this record.

Recommended action

Review the official publisher document before deployment.

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Debian 12 BookwormOpen lifecycle record →

Official publisher evidence

DEBIANVERIFIED

DSA-6510-1 xdg-dbus-proxy - security update

Checked 28 Sep 2026. BlackTree preserves the last verified facts if a later source check is temporarily unavailable.

Open the official publisher source