Version in base suite: 4.1.0~beta2+dfsg-3+deb13u1 Base version: transmission_4.1.0~beta2+dfsg-3+deb13u1 Target version: transmission_4.1.0~beta2+dfsg-3+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/t/transmission/transmission_4.1.0~beta2+dfsg-3+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/t/transmission/transmission_4.1.0~beta2+dfsg-3+deb13u2.dsc changelog | 6 ++++++ patches/CVE-2026-38978.patch | 33 +++++++++++++++++++++++++++++++++ patches/series | 1 + 3 files changed, 40 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmphcfxr2bx/transmission_4.1.0~beta2+dfsg-3+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmphcfxr2bx/transmission_4.1.0~beta2+dfsg-3+deb13u2.dsc: no acceptable signature found diff -Nru transmission-4.1.0~beta2+dfsg/debian/changelog transmission-4.1.0~beta2+dfsg/debian/changelog --- transmission-4.1.0~beta2+dfsg/debian/changelog 2025-08-23 16:17:20.000000000 +0000 +++ transmission-4.1.0~beta2+dfsg/debian/changelog 2026-08-31 22:05:34.000000000 +0000 @@ -1,3 +1,9 @@ +transmission (4.1.0~beta2+dfsg-3+deb13u2) trixie; urgency=medium + + * CVE-2026-38978 + + -- Moritz Mühlenhoff Tue, 01 Sep 2026 00:05:34 +0200 + transmission (4.1.0~beta2+dfsg-3+deb13u1) trixie; urgency=medium * fix GTK app crash when LANG=fr (Closes: #1108194, #1110257) diff -Nru transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch --- transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch 1970-01-01 00:00:00.000000000 +0000 +++ transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch 2026-08-31 22:05:34.000000000 +0000 @@ -0,0 +1,33 @@ +From e51d77e202206ee1389cbd6d9ab154421942b530 Mon Sep 17 00:00:00 2001 +From: Charles Kerr +Date: Tue, 31 Mar 2026 09:13:32 -0500 +Subject: [PATCH] fix: add clickjack safeguards when serving http responses + (#8747) (#8749) + +--- transmission-4.1.0~beta2+dfsg.orig/libtransmission/rpc-server.cc ++++ transmission-4.1.0~beta2+dfsg/libtransmission/rpc-server.cc +@@ -175,7 +175,15 @@ namespace + { + int constexpr DeflateLevel = 6; // medium / default + +-// --- ++// Prevent clickjacking on the browser-facing WebUI and RPC responses. ++// https://github.com/transmission/transmission/issues/8726 ++// https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html. ++void add_clickjacking_prevention_headers(struct evkeyvalq* headers) ++{ ++ // Send X-Frame-Options for older browsers + CSP frame-ancestors for newer ones ++ evhttp_add_header(headers, "X-Frame-Options", "SAMEORIGIN"); ++ evhttp_add_header(headers, "Content-Security-Policy", "frame-ancestors 'self'"); ++} + + void send_simple_response(struct evhttp_request* req, int code, char const* text = nullptr) + { +@@ -499,6 +507,7 @@ void handle_request(struct evhttp_reques + + auto* const output_headers = evhttp_request_get_output_headers(req); + evhttp_add_header(output_headers, "Server", MY_REALM); ++ add_clickjacking_prevention_headers(output_headers); + + if (server->is_anti_brute_force_enabled() && server->login_attempts_ >= server->settings().anti_brute_force_limit) + { diff -Nru transmission-4.1.0~beta2+dfsg/debian/patches/series transmission-4.1.0~beta2+dfsg/debian/patches/series --- transmission-4.1.0~beta2+dfsg/debian/patches/series 2025-08-20 09:41:32.000000000 +0000 +++ transmission-4.1.0~beta2+dfsg/debian/patches/series 2026-08-31 22:05:34.000000000 +0000 @@ -5,3 +5,4 @@ web-easier-build.patch 0003-disable-git-hook-installation.patch 0004-do-not-mess-revision.patch +CVE-2026-38978.patch