-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 03 Nov 2026 18:23:16 +0100
Source: lomiri-download-manager
Architecture: source
Version: 0.2.1-3+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian UBports Team <team+ubports@tracker.debian.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Changes:
 lomiri-download-manager (0.2.1-3+deb13u1) trixie; urgency=medium
 .
   * debian/patches:
     + Add 0001_src-downloads-dont-run-commands-when-privileged.patch and
       0002_src-uploads-downloads-daemon-conf-deny-access-to-system.patch.
       CVE-2026-96424: Fix incorrect DBus policy for lomiri-upload-manager
       (part of lomiri-download-manager) that allows arbitrary user to read
       arbitrary file as root over DBus Source.
       CVE-2026-96425: Fix incorrect DBus policy for lomiri-download-manager
       that allows arbitrary user to run arbitrary command as root over DBus.
   * debian/control:
     + Add to B-D: libcap-dev.
Checksums-Sha1:
 ae681aef1568c8b0738f478068556dae38cf7a3e 4902 lomiri-download-manager_0.2.1-3+deb13u1.dsc
 8e2a474d9801a2f84096aec6c9e35104833a7578 24292 lomiri-download-manager_0.2.1-3+deb13u1.debian.tar.xz
 7d21c4101ce02420e45ac0d43663c09a171df2dd 20434 lomiri-download-manager_0.2.1-3+deb13u1_source.buildinfo
Checksums-Sha256:
 1ed13d1af76b1635993f75f73c78331dbdd07cf266b26a336585c7949af5f1e4 4902 lomiri-download-manager_0.2.1-3+deb13u1.dsc
 a4f4213d4cac04b8c59ffc4176aa31b5d33b3663d20a80f9fa201b3a5165b14d 24292 lomiri-download-manager_0.2.1-3+deb13u1.debian.tar.xz
 8a134301b65510e9c9dd9254f13fb36fcec844dc3cefda61cfce8daf350cc502 20434 lomiri-download-manager_0.2.1-3+deb13u1_source.buildinfo
Files:
 849584d9f75b104efdcf10fee1a20bae 4902 net optional lomiri-download-manager_0.2.1-3+deb13u1.dsc
 023c614b8fd781815c36b2c684d320ab 24292 net optional lomiri-download-manager_0.2.1-3+deb13u1.debian.tar.xz
 1374f36c0d1d02c46ef14f1184bb575a 20434 net optional lomiri-download-manager_0.2.1-3+deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJJBAEBCgAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmrqGsEVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxUmsP/Rj6BUh0DWXRypAYR4mwuPbwtbA5
/zrbcT96EuJ67CL5U2rKoXoIaP999LNtuhscaeUqtCR5pe9vEZUTfzk2nqiwtkr1
5t5Ku6ugqKosB+9S/2QEbCp85rstuj6OVrfHT9FX1Ya8+/wJgbMzdKAcsALZcDFn
kuMp3JJtA9p0qx7PDTVRzrki5HV6NwmqZgX0lQ7oHU/WF3+bYwteXdn9jqWgvwR7
NK/8s6np152N1yn792DHSwbYx92fevMrtkHdtZjNCnTTEAVXGGkociBkNNdcLBUy
N3Lu2K1JyJrYU0fDgQ0++YVGmJHKBNpFKx522LcUN0gyCamlfw+LHuxkvm6XZQrS
B2JRBGDVrg9k+9LDJ6xPe3OLHsBpklna8cVSsLGfCjZ492nmoMNbn6yXiUd7etHL
YuJpTRmaGhNbcX/zI7e5PKztFnU6OsqcxHn6X8eVcRfmwl3CvAQtIYRO/FqE0w8h
oa8Uv43a3Apr9O0VtwE2merxUSxxRiuTk7oGKdJLozH06k3LJ3lVhgphJ1DzjR/F
YjyGJ2kVeEPeq80iV9HZ2/yrf6Fa375g4PF+uyQo2tAWGl2QjLOc2S6akCDvH0+y
rkgT/I36r+HkeNLcEcL7baMB46BAJhNG6L7bS745sKwVwS3SXdYzC5p3/fL9syoV
0DkSmYh6GUcD9OTy
=yMPH
-----END PGP SIGNATURE-----