[From nobody Fri Oct 2 16:19:07 2026 Received: (at 1149218-close) by bugs.debian.org; 2 Oct 2026 15:17:46 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST,WORD_WITHOUT_VOWELS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 81; hammy, 150; neutral, 249; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:53964) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf17-003jUZ-0T for 1149218-close@bugs.debian.org; Fri, 02 Oct 2026 15:17:46 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf16-001Jho-2Q for 1149218-close@bugs.debian.org; Fri, 02 Oct 2026 15:17:44 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=/P0wrsud97IoafDOqukDCCR/21/BfVs6GkDULFC8CV8=; b=B3efHa2Mj6RxYE/uvTmn3Rxg+u wAOvE4tNMIsh6P7shiVGg+ewCKkB7KymCYb6liSUcp8O6nrxu3ZdNtz2vn6Ir6Q0nFoz9FI4WRedi MHtFrQtjBvz4ZBK/AQODG7K3KjLZXzX59V23QSGLTmUWO2Ro0aGaXEs0+PlbESnkpwk8TKLFzyYri pcb8+LHOK4bg4zufqeL8FaHiL14U3qwmava8OIutLguL9z3ft0cuahoaulu4e7CNwV6czudyTubab fSLREzeVb+C0Iiwvt4JsVS6GZg2wnsICFMV53d6oWREAlxVMANyzq2JbI5x6eHTHIjr3s0h7RsGGO PP1L471A==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xCf15-0000000470e-3g0G; Fri, 02 Oct 2026 15:17:43 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Simon McVittie <smcv@debian.org> To: 1149218-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: flatpak Debian: DAK Debian-Changes: flatpak_1.16.6-1~deb13u3_source.changes Debian-Source: flatpak Debian-Version: 1.16.6-1~deb13u3 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1149218: fixed in flatpak 1.16.6-1~deb13u3 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============3372294822807458352==" Message-Id: <E1xCf15-0000000470e-3g0G@fasolo.debian.org> Date: Fri, 02 Oct 2026 15:17:43 +0000 --===============3372294822807458352== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: flatpak Source-Version: 1.16.6-1~deb13u3 Done: Simon McVittie <smcv@debian.org> We believe that the bug you reported is fixed in the latest version of flatpak, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1149218@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Simon McVittie <smcv@debian.org> (supplier of updated flatpak package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 28 Sep 2026 14:13:01 +0100 Source: flatpak Architecture: source Version: 1.16.6-1~deb13u3 Distribution: trixie-security Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debi= an.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1149218 Changes: flatpak (1.16.6-1~deb13u3) trixie-security; urgency=3Dhigh . * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218): - Fix two related symlink traversal vulnerabilities to prevent arbitrary file deletion and limited file overwriting outside the deploy directory, and harden related code paths against symlink traversal (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54) (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf) - When using OCI remotes, don't make authentication token readable by other users (CVE-2026-97025, GHSA-7rvf-rqr3-43j4) - Restrict permissions of temporary directories /var/tmp/flatpak-cache-* (CVE-2026-97026, GHSA-r9w3-qx54-qvc8) - Filter D-Bus .service files and freedesktop.org .desktop files with an allowlist to prevent denial of service and possibly sandbox escape (CVE-2026-97027, GHSA-v64f-hrwr-j4vh) - Prevent sandboxed processes from killing a parent process outside the sandbox (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2) * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry Checksums-Sha1: f72674b664b1c7c111c6648d098e11952982f536 3741 flatpak_1.16.6-1~deb13u3.dsc b6d693e6c8de02f7fa16821645c8bc38172dfbc3 86412 flatpak_1.16.6-1~deb13u3.debi= an.tar.xz e88ee46b27a06247220e7ef2f7214ea04a12105f 15479 flatpak_1.16.6-1~deb13u3_sour= ce.buildinfo Checksums-Sha256: 5f4bb9d94e039f6c0c35c28b22b2d0f6030b6d83560d8c80996c399a7a43b142 3741 flatpa= k_1.16.6-1~deb13u3.dsc 21cf5dbf20f453f007476322f864552b45a0f8521d86b907c7a015fba82141ac 86412 flatp= ak_1.16.6-1~deb13u3.debian.tar.xz a7a6bb191854b17889c755b5f30bf83116897f76f114ca9f8e7e259933a3ec82 15479 flatp= ak_1.16.6-1~deb13u3_source.buildinfo Files: f03cade7037f07cc784b8a261c6cc7d0 3741 admin optional flatpak_1.16.6-1~deb13u= 3.dsc 10f95f8be7b5fef7889275e0fd2c0ec2 86412 admin optional flatpak_1.16.6-1~deb13= u3.debian.tar.xz 5be08845ca189203fc6f123b924513e9 15479 admin optional flatpak_1.16.6-1~deb13= u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmq6bjgACgkQI1wJnT6z MHYH6Q//bnRqvZaYgiWNVLUeK8WN8L8K2IJXRsUfhEwUhNQP+mB8AL6buz9s0Mfy rJfrGsKvgq61Z6S0JMs9zNUPHVvqh+fT4mjJ+Z+8r9jLjjumsIQqdhHFlDSVGKzQ 0hc2K665Zc5Y+eIHHx3K0zrNzfiwCrnTkxvDRB110NGQdspcDGKf1koBN7fXCJb3 znEQDwNFwTDYd7QqfNl1lNs327cPZnS6MDsxJFCBWplS/kLvbiGAZ8RdJH5IyYkq xtdRgsxT/xkKu+WnnLXvbyeBaxWAyPPXYYhf/kcYgHDEU2GHy1BfD7o1+0ueBJVf VWLltG+2jy/OHFcKm8d6Xky2rT6PBiInpwxscJTk0K/23nxEXGEpwmtFVHxDgcP9 1/dkBUIiyCfSUj5lxiRAXVaYhCFyoPi6K3IW5iy6Tzj9Y21N0IqAtmeqwc6y8WVh GnCQT1C/J25FisFGFYdgPP0k73Krj7/zCRA72iU1w2nksx+SerRnDOgeXswpL2+L jqzwjm/ki/5wfkVONaobCC63F8tCybmcOqZ8Q7RC8+xQ/TYsJoufB4loQOgRWg3P IW11em3DagI5bZb44VuCloQxg9qgkdq6HXOTDkgUFVHKIUDDfZy97Vc6hKRMNawK LuwCSychmxMfljRwEkR/DQWFdbx+xaKU24loMF0UOb9df7lZ068=3D =3Dihbl -----END PGP SIGNATURE----- --===============3372294822807458352== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCar/LFwAKCRCb9qggYcy5 IZv5AP9od6ACerxMHZfuuZHNiU2U/VMThHOnlbdpYBo+hiJq5AEAqntDrotAaaDF WRbLJrZOQqqJdxlQRX8/lpnsK95kNgE= =izwV -----END PGP SIGNATURE----- --===============3372294822807458352==-- ]