xdg-dbus-proxy vulnerabilities

xdg-dbus-proxy before version 0.1.9 has an incorrect implementation of message filtering that allows an attacker to bypass intended filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox.

xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted.

xdg-dbus-proxy before version 0.1.7 has a policy parser vulnerability that allows bypassing eavesdrop restrictions. The proxy mishandles cases like 'eavesdrop ='true'' (with a space before the equals sign), enabling clients to intercept D-Bus messages they should not have access to.