UbuntuUpdates.org

Package "xdg-desktop-portal"

Name: xdg-desktop-portal

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • desktop integration portal - automated tests
Latest version: 1.18.4-1ubuntu2.24.04.2
Release: noble (24.04)
Level: updates
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "xdg-desktop-portal" in Noble

Repository Area Version
base universe 1.18.3-1ubuntu1
base main 1.18.3-1ubuntu1
security main 1.18.4-1ubuntu2.24.04.2
security universe 1.18.4-1ubuntu2.24.04.2
updates main 1.18.4-1ubuntu2.24.04.2

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.18.4-1ubuntu2.24.04.2 2026-05-20 20:07:24 UTC

  xdg-desktop-portal (1.18.4-1ubuntu2.24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: Symlink Redirection Attack in g_file_trash
    - debian/patches/CVE-2026-40354-pre1.patch: Add libglnx dependency in
      meson.build and subprojects/libglnx.wrap
    - debian/patches/CVE-2026-40354-pre2.patch: use Call over Requests in
      src/gamemode.c,
      ../memory-monitor.c,
      ../network-monitor.c,
      ../proxy-resolver.c,
      ../realtime.c,
      ../trash.c, and
      ../xdg-desktop-portal.c
    - debian/patches/CVE-2026-40354-1.patch: Use File Descriptors rather than
      g_file_trash to avoid race conditions when trashing file in src/trash.c
    - debian/patches/CVE-2026-40354-2.patch: Fix trashing files on older
      versions of glib in src/trash.c
    - CVE-2026-40354
  * xdg-desktop-portal_1.18.4.orig-libglnx.tar.gz: Add vendored libglnx
    at ccea836b799256420788c463a638ded0636b1632.
  * debian/rules: Add symlink to vendored libglnx in submodules/libglnx
  * debian/clean: Remove vendored libglnx symlink after build

 -- Kyle Kernick <email address hidden> Thu, 23 Apr 2026 15:56:27 -0600
Source diff to previous version
CVE-2026-40354 Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack o

Version: 1.18.4-1ubuntu2.24.04.1 2024-09-26 22:06:56 UTC

  xdg-desktop-portal (1.18.4-1ubuntu2.24.04.1) noble; urgency=medium

  * Refresh webextensions portal patch to latest version proposed
    upstream (LP: #2077587)
    - Backported tree:
      https://github.com/ubuntu/xdg-desktop-portal/tree/nmp-1.18-backport

 -- Amin Bandali <email address hidden> Mon, 26 Aug 2024 10:56:42 -0400
Source diff to previous version
2077587 Refresh WebExtensions portal patch

Version: 1.18.4-1ubuntu2 2024-07-11 18:07:19 UTC

  xdg-desktop-portal (1.18.4-1ubuntu2) noble; urgency=medium

  * Merge with Debian (LP: #2062394). Remaining change:
    - Import https://github.com/flatpak/xdg-desktop-portal/pull/705 as a
      distro-patch to add a portal for managing WebExtensions native messaging
      servers
2062394 Update xdg-desktop-portal to 1.18.4


About   -   Send Feedback to @ubuntu_updates