[From nobody Mon Sep 28 14:37:08 2026 Received: (at 1149218-close) by bugs.debian.org; 28 Sep 2026 13:34:18 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 94; hammy, 150; neutral, 235; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:57222) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xBBUo-007sdz-0x for 1149218-close@bugs.debian.org; Mon, 28 Sep 2026 13:34:18 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xBBUm-00A2KL-16 for 1149218-close@bugs.debian.org; Mon, 28 Sep 2026 13:34:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=zcDoUIrBTvjzOUPMWsiF0WA6qbtteSSevXudGDifNZ0=; b=rIBDElzInFdteo2ejJfW88Thvs binVbukJnK+t4Dm6niKubQf8zjAujfliwyKVdwoBtA1jiIcIn9+NL6orPJ9DK7nN2RZbjzY9qqC0+ Z6pbddf/mD4NWQ58CavBeqQT9f07DALzqi1hWyjQo7JsSgDEaLvxQk9TfGQsYyM5SyyMnCX2BqYpG dnj9HNxuUxxPgce40TKKHljy2NGltKZobrwkW+6ImRtwNAwazgOtEXUgA3+/C1uKF1NgynVw7tS9u aFwP5Y1gh6INqs4lPz8ooI4RhMB5nhKBtJTvR7doWMOHnkuaY93F9YxkOc/vaJlnQdRQkSsZRs6TZ 6wp1BOzw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xBBUl-00000003WNF-0gs0; Mon, 28 Sep 2026 13:34:15 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Simon McVittie <smcv@debian.org> To: 1149218-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: flatpak Debian: DAK Debian-Changes: flatpak_1.18.4-1_source.changes Debian-Source: flatpak Debian-Version: 1.18.4-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1149218: fixed in flatpak 1.18.4-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============1136740858784847841==" Message-Id: <E1xBBUl-00000003WNF-0gs0@fasolo.debian.org> Date: Mon, 28 Sep 2026 13:34:15 +0000 --===============1136740858784847841== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: flatpak Source-Version: 1.18.4-1 Done: Simon McVittie <smcv@debian.org> We believe that the bug you reported is fixed in the latest version of flatpak, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1149218@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Simon McVittie <smcv@debian.org> (supplier of updated flatpak package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 28 Sep 2026 14:10:44 +0100 Source: flatpak Architecture: source Version: 1.18.4-1 Distribution: unstable Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debi= an.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1149218 Changes: flatpak (1.18.4-1) unstable; urgency=3Dhigh . * New upstream security fix release (Closes: #1149218) - Fix two related symlink traversal vulnerabilities to prevent arbitrary file deletion and limited file overwriting outside the deploy directory, and harden related code paths against symlink traversal (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54) (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf) - Don't write authentication token to disk when using OCI remotes (CVE-2026-97025, GHSA-7rvf-rqr3-43j4) - Restrict permissions of temporary directories /var/tmp/flatpak-cache-* (CVE-2026-97026, GHSA-r9w3-qx54-qvc8) - Filter D-Bus .service files and freedesktop.org .desktop files with an allowlist to prevent denial of service and possibly sandbox escape (CVE-2026-97027, GHSA-v64f-hrwr-j4vh) - Prevent sandboxed processes from killing a parent process outside the sandbox (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2) Checksums-Sha1: 967772d60a4df907b967ed12d82221a70a957836 4054 flatpak_1.18.4-1.dsc 645233c14269778626bb877ea0816c7e34f01326 1363232 flatpak_1.18.4.orig.tar.xz 096aa4bf12b1a0cfd8e9146768cc7c06ff5815a3 44348 flatpak_1.18.4-1.debian.tar.xz 633323fae0dcaec032c9639c582bf012c00a7f76 4471020 flatpak_1.18.4-1.git.tar.xz 5246a7780895cf5d960d147997b791ad55376a5f 17728 flatpak_1.18.4-1_source.build= info Checksums-Sha256: 06a57f749603be0c70aea4e096c8370f4dc20a6c8c1f0c140d1b7d2d2e9982d2 4054 flatpa= k_1.18.4-1.dsc b899a7a00c48d2c626cb8ec33fe556720b376c25805d7222430c0fdca4c6ac8d 1363232 fla= tpak_1.18.4.orig.tar.xz 9c9ff4be6c5e038b3829ace710baa0480452f299504d7b1c9ea653f96ee354b9 44348 flatp= ak_1.18.4-1.debian.tar.xz 6b7ccbd0a3c874d825ae9280bd03255bd7ed459b04d16d57358de334ecc92151 4471020 fla= tpak_1.18.4-1.git.tar.xz b56a313cd736a826be6d07f3dab488d94394bc242c22a105759a8de364f320ca 17728 flatp= ak_1.18.4-1_source.buildinfo Files: f3a7aeb93563e902bbb86d987dcfbdc1 4054 admin optional flatpak_1.18.4-1.dsc 70b21dc1d5e7672fd7b64bc645d74fbc 1363232 admin optional flatpak_1.18.4.orig.= tar.xz a0c78c02ee3e109725a9ddf0a686068d 44348 admin optional flatpak_1.18.4-1.debia= n.tar.xz cbd5284db4f1ab9cdddaba3df3290476 4471020 admin None flatpak_1.18.4-1.git.tar= .xz 263f8468de4b8bb768d759caedfaba1e 17728 admin optional flatpak_1.18.4-1_sourc= e.buildinfo Git-Tag-Info: tag=3D83af0460a22a7c14fbb9a8753adf61346f5c2f81 fp=3D7a073ad1ae6= 94fa25bff62e5235c099d3eb33076 Git-Tag-Tagger: Simon McVittie <smcv@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmq6Z/MACgkQYG0ITkaD wHnfaBAA6MKbi916G052dA351W0pNDvezTaT5ev6dzFpgYEDIBImFPXJ+vdBpdAt I4aqLR6L1oWgPyaYiWtXEyOxWfXAslsRSYJ5lKogwC4Ei890hEyekDPSAp7rdcsn EbYPNS1utjLYNnnU8NTwkfQ4VAhTABoJbXMerUHFOEDPC1EXBtrbFbPrSoxz2AjE 2hKwSpcPUsV3IEKEI/oRP7jqBTaV2ujIkeCVVxDOO6tDZ3V50IYgCtXvCeMoxmf/ Ubfw9l5mnOksm8HZTniE5NG7Mm0OIzzpow7Hghe+9Ggcd1OPv3cM9KVAPlqp8iUk CLJtCSJV9iDuH+3+9EYYXI8/CZgdVNFJOdlzdLeRwU1gTPY/YFwLy5KtXjbUC366 PtkyVTiOq5x5gbVxtKx3JkXtL9pDgWyDzzc2t9Tce5GPBFuYc//HhXRje6BPJv6s 6Bkusd4lbxVroeJuU3SGeqeaz4W9YGrIoxkChxU+iS7tjvokC7uzqZLsOkG0HUws HajmhK8d3pVU+SaksCQmgVtmkJwoulf0d4xUNnYAKp6MalduhPs8ihHo+RleDP04 xWcnFZZBBRPXz8Sux4fKiHVoLt6qw9gQ1DSCWgkwF8s9KkjOB7xrUCjDTaMx/t6M Sm589KojvUUMJjrAJQDVUbQ4d8uit6X8SZBjCtNWMmZ8yOwSLHg=3D =3DlUkg -----END PGP SIGNATURE----- --===============1136740858784847841== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCarps1wAKCRCb9qggYcy5 IR0lAQCZhi863iPW6khghLxzVh7br1TklJ596LfNY2rYRq3wMwD7BW1NtRHJscHC oM2M5mZR3ygAGx6oW2V/uS0017Scrgc= =i5m+ -----END PGP SIGNATURE----- --===============1136740858784847841==-- ]