[From nobody Wed Aug 26 12:21:06 2026 Received: (at 1145655-close) by bugs.debian.org; 26 Aug 2026 11:19:33 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 86; hammy, 150; neutral, 214; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:34578) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wzBfI-007xH3-1b for 1145655-close@bugs.debian.org; Wed, 26 Aug 2026 11:19:32 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wzBfG-002SIT-0d for 1145655-close@bugs.debian.org; Wed, 26 Aug 2026 11:19:30 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=KUKsdXia6tjAWFnxPR7ItUOHW60KuRhLzdIFQi/AEjs=; b=Pusm4+mfTxESMntrmRP2zW5Lk5 gX+eyXBw3VsmAvB5NS8EZMuHhiokYzvXFRVBrtz5CrOBJwRV2ntJn7Cqccdbg8Qjm5siSoAkcoZBw AWmrP3CRME1UggRaI5kunAdZjR/P+jlQ+w/mkLAInXovWgteYmoBM36wMs0DMcEOoxZqQayDdbDuG Vw7Nkn9vKk6LJoBPpNgAVjdYejahX2uXLZYcI69xItdZuVEHcrW6VXynxz1bErNy/a7EFpFhOkYGJ vwMKdCbQslEPSp+Of9fmLgpuFU0L5cmX8DlcbPMsV1gxGD45NC0QCc1QWkfCwYwNJPuWSEzHXxSOA WIONIHXQ==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wzBfE-00000000WAR-45pR; Wed, 26 Aug 2026 11:19:28 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Simon McVittie <smcv@debian.org> To: 1145655-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: bubblewrap Debian: DAK Debian-Changes: bubblewrap_0.12.0-1_source.changes Debian-Source: bubblewrap Debian-Version: 0.12.0-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1145655: fixed in bubblewrap 0.12.0-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============4429548209939820116==" Message-Id: <E1wzBfE-00000000WAR-45pR@fasolo.debian.org> Date: Wed, 26 Aug 2026 11:19:28 +0000 --===============4429548209939820116== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: bubblewrap Source-Version: 0.12.0-1 Done: Simon McVittie <smcv@debian.org> We believe that the bug you reported is fixed in the latest version of bubblewrap, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1145655@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Simon McVittie <smcv@debian.org> (supplier of updated bubblewrap package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 26 Aug 2026 11:32:16 +0100 Source: bubblewrap Architecture: source Version: 0.12.0-1 Distribution: unstable Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debi= an.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1145655 Changes: bubblewrap (0.12.0-1) unstable; urgency=3Dhigh . * New upstream release - Prevent sandbox escape via symlink traversal. If an app framework such as Flatpak mounts subdirectories into a directory controlled by the sandboxed app, a malicious or compromised sandboxed app could create symlinks in that directory to arrange for files/directories to be created on the host system. (GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655) - d/rules: Stop passing -Dsupport_setuid=3Dfalse. The option no longer exists, and the new version of bubblewrap always behaves as though its value was false. - d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstre= am - d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.p= atch: Adjust patch to apply to the new upstream release * d/rules: Don't compile fallback code paths for kernel older than 5.10. This ensures that we're using the safest available mechanisms, using the openat2() syscall rather than emulating it in user-space. As a result, this version will not work on kernels older than the one found in Debian 11. Checksums-Sha1: 4ee70163fd95377cf5737e87729bc448401abacb 2427 bubblewrap_0.12.0-1.dsc 183eaff6b078c1ea5ad55271e7d1fa5c8c0d339e 126452 bubblewrap_0.12.0.orig.tar.xz 5a2bfd116f752cadb6c21ca2e48646bb97dcfb2c 13092 bubblewrap_0.12.0-1.debian.ta= r.xz 5dfd9cab67a11e66f92a1316510eee7599591f67 7139 bubblewrap_0.12.0-1_source.bui= ldinfo Checksums-Sha256: e81987f8d90b30b581299870592affaa8d9a17caf05112d303916312b7afd60a 2427 bubble= wrap_0.12.0-1.dsc 9760d007363e3abba7c747489910f9f82d9fca53ba3bd3282e396fa3c97a3314 126452 bubb= lewrap_0.12.0.orig.tar.xz 60691fa8488db2de4dd19d59fb0b084e692695c38616dcf8e20b08a4d372ab93 13092 bubbl= ewrap_0.12.0-1.debian.tar.xz 65322f643cfcd5b05b63231055655f62f860b2e84d4e4eb681a9d2047cb4aef6 7139 bubble= wrap_0.12.0-1_source.buildinfo Files: 9652e93e58dd3c2c5a9a631d6f4775fe 2427 admin optional bubblewrap_0.12.0-1.dsc 323b059c9599b60b456bcf9e9800ff44 126452 admin optional bubblewrap_0.12.0.ori= g.tar.xz 255ccb24268c5460325edced14f15c9d 13092 admin optional bubblewrap_0.12.0-1.de= bian.tar.xz 32130cf24c6258998317dbc4e3b634c4 7139 admin optional bubblewrap_0.12.0-1_sou= rce.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmqOyVAACgkQI1wJnT6z MHZl0RAAoIZj+59Kvx30Qvy7LFAJkH8YidqCQARbviv189MQ64/3F+p3tA1+p/g+ wGT/CbcrOe+Iak51pAdUHcAd3Dudd6Dta4vejkHvg3JbYON1DoigEcclYbxNdGG3 eignRxihI/E7Wlu2W3cOTNL12JGfWKTjJeTJxG2L58gxi7jXnJ2sQkANtu7t1WRh dcq4tJvX2rwiSMMzr9cYWlCm5MFYJ7E0jkCEuHVvtMcgisjf2bahlgADcSyazPKJ nSkW2JyvfIKuyB4kgsjT1YVwhSzKlp06fhsoDBxmtnRB2ZnGq8V0srA7K/Zo97zw +MCh7cMus7jXwjgK/PJ3pZbwYnjGpfiMc7Lpaljiue64UXnfRNlSqDdBfjC9lQfU JQWs5phmLoP/DrAxguKNa6m+YSPvK4BTpHjHnu8hHKftIorB3207TXjiZyLSx0wR DBvI2W2YYoV8ibk4bC32G6Nvcs9+GcC5oTEVJFw/RlYqUugOFD3d8HlFQVVSSRbu mhkp8VvKOJAwaRHoB4asdRIvtZ0WzQ3hrj2y4ps1iiH1UyTNmatD/XhWRJuDWv7k Ar4DDsUa3osAuwfYX7/8mBi24YO6oWOk0gLZOtAWQtfupkVTIV0Zgl2st6fjZ2Mo S7qn2j1YMwtjUncogR1WavqH8pa2eNr5pCJ+q/q1cty8yxA8Svo=3D =3DfE3x -----END PGP SIGNATURE----- --===============4429548209939820116== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCao7LwAAKCRCb9qggYcy5 IchuAQCu/5IM/MqmJ4/8iBSA53D6WG93b2xBriAX3TKWM8q44wEAn2RnWCJCYcCK Vi6rqzLiEBA84eEQEJy5wbt9OxI6owE= =RQAm -----END PGP SIGNATURE----- --===============4429548209939820116==-- ]