[Git][security-tracker-team/security-tracker][master] CVE assigned for flatpak-builder issue

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7c555e2b by Salvatore Bonaccorso at 2026-10-09T11:27:40+02:00
CVE assigned for flatpak-builder issue

- - - - -


2 changed files:

- data/CVE/list
- data/next-point-update.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -606,8 +606,6 @@ CVE-2026-107510 (An authenticated high privilege user can inject arguments in tr
 	NOT-FOR-US: Infoblox NIOS
 CVE-2026-107503 (Unvalidated environments URL allows OAuth authorization code + PKCE ve ...)
 	TODO: check
-CVE-2026-107466 (A flaw was found in flatpak-builder. This vulnerability allows an atta ...)
-	TODO: check
 CVE-2026-107406 (Memory overflow vulnerability leading to Remote Code Execution or Deni ...)
 	NOT-FOR-US: NetScaler
 CVE-2026-107399 (The Mechanize library is used for automating interaction with websites ...)
@@ -35191,7 +35189,7 @@ CVE-2026-93337 (NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an
 	- network-manager-l2tp 1.52.6-1
 	NOTE: https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-rp84-8h2r-5xc3
 	NOTE: Fixed by: https://github.com/nm-l2tp/NetworkManager-l2tp/commit/64879ce0ad866f7c9a45babe4d95731a916ea00f (1.52.6, 1.20.26)
-CVE-2026-XXXX [GHSA-484h-v688-jq5j: Source URL scheme bypasses sandboxed mode protections across multiple source subtypes]
+CVE-2026-107466  [GHSA-484h-v688-jq5j: Source URL scheme bypasses sandboxed mode protections across multiple source subtypes]
 	- flatpak-builder 1.4.11-1 (bug #1147701)
 	[trixie] - flatpak-builder <no-dsa> (Minor issue)
 	[bookworm] - flatpak-builder <postponed> (Minor issue)


=====================================
data/next-point-update.txt
=====================================
@@ -280,7 +280,7 @@ CVE-2026-14330
 	[trixie] - pipewire 1.4.2-1+deb13u1
 CVE-2026-86320
 	[trixie] - flatpak-builder 1.4.4-2+deb13u1
-CVE-2026-XXXX [GHSA-484h-v688-jq5j]
+CVE-2026-107466
 	[trixie] - flatpak-builder 1.4.4-2+deb13u1
 CVE-2026-54603
 	[trixie] - ruby-oauth2 2.0.9-1+deb13u1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7c555e2b15e4cc73ccc3224a5012a7c6ba1dbcf1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7c555e2b15e4cc73ccc3224a5012a7c6ba1dbcf1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/0adf689a/attachment.htm>