From totaam at xpra.org Fri Jul 3 18:38:08 2026 From: totaam at xpra.org (Antoine Martin) Date: Sat, 4 Jul 2026 00:38:08 +0700 Subject: [winswitch] [SECURITY ADVISORY] multiple serious vulnerabilities Message-ID: Hi, All xpra versions prior to today's releases are vulnerable to at least one full remote command execution bug. The most serious bug requires little user intervention to gain full access to the system. Removing xpra's URL handler association may not be sufficient to protect from this bug. The other vulnerabilities are only slightly less serious, and can still lead to a client system being compromised. They can be mitigated by turning off the `file-transfer` and `printing` options. Please update all your clients as soon as possible. The fixed versions available today are v6.5.1: https://github.com/Xpra-org/xpra/releases/tag/v6.5.1 And v5.1.6 LTS: https://github.com/Xpra-org/xpra/releases/tag/v5.1.6 Cheers, Antoine From totaam at xpra.org Mon Jul 27 07:05:45 2026 From: totaam at xpra.org (Antoine Martin) Date: Mon, 27 Jul 2026 13:05:45 +0700 Subject: [winswitch] [ANNOUNCE] Xpra 6.5.2 Message-ID: <279396fc-a88c-4758-b5a2-e2a8a33faf8e@xpra.org> Hi, This stable update contains the usual mix of fixes. The only two that stand out are the macOS crash with audio events and the misapplied keyboard layout with some platform combinations. The wayland server backend is now also available as a package for some DEB distributions. There is no urgency to update if you are not affected. For more details: https://github.com/Xpra-org/xpra/releases/tag/v6.5.2 Cheers, Antoine