Amazon Linux 2023 Security Advisory: ALAS2023-2026-3185
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
Severity:
Important
Issue Overview:
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages.
xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox.
If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated. (CVE-2026-94422)
Affected Packages:
xdg-dbus-proxy
Issue Correction:
Run dnf update xdg-dbus-proxy --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3185 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
xdg-dbus-proxy-debugsource-0.1.9-1.amzn2023.0.1.aarch64
xdg-dbus-proxy-debuginfo-0.1.9-1.amzn2023.0.1.aarch64
xdg-dbus-proxy-0.1.9-1.amzn2023.0.1.aarch64
src:
xdg-dbus-proxy-0.1.9-1.amzn2023.0.1.src
x86_64:
xdg-dbus-proxy-debugsource-0.1.9-1.amzn2023.0.1.x86_64
xdg-dbus-proxy-debuginfo-0.1.9-1.amzn2023.0.1.x86_64
xdg-dbus-proxy-0.1.9-1.amzn2023.0.1.x86_64