Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

xdg-dbus-proxy can let unauthorized apps read messages

published 5 months ago

Summary

The xdg-dbus-proxy component, which filters communication between programs, had a parsing flaw that let some applications listen to messages they shouldn't see. This could expose sensitive data exchanged between software. Updating to version 0.1.7 or later resolves the issue; apply the latest update as soon as possible.

What to do

Update openeuler xdg-dbus-proxy to version 0.1.2-2.oe2403sp3.

Affected software

Ecosystem	Vendor	Product	Affected versions
openEuler:24.03-LTS-SP3	openeuler	xdg-dbus-proxy	< 0.1.2-2.oe2403sp3 Fix: upgrade to 0.1.2-2.oe2403sp3

Original advisory text

xdg-dbus-proxy security update

xdg-dbus-proxy is a filtering proxy for D-Bus connections. It was originally part of the flatpak project, but it has been broken out as a standalone module to facilitate using it in other contexts.

Security Fix(es):

xdg-dbus-proxy is a filtering proxy for D-Bus connections. Prior to 0.1.7, a policy parser vulnerability allows bypassing eavesdrop restrictions. The proxy checks for eavesdrop=true in policy rules but fails to handle eavesdrop ='true' (with a space before the equals sign) and similar cases. Clients can intercept D-Bus messages they should not have access to. This vulnerability is fixed in 0.1.7.(CVE-2026-34080)

References

https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34080 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Timeline

Published9 May 2026

Updated21 Aug 2026

First seen21 Aug 2026

Sources

OESA-2026-2212 · OSV

Track software like this

Free during beta