[Git][security-tracker-team/security-tracker][master] CVE-2026-90616/flatpak assigned

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
948570df by Salvatore Bonaccorso at 2026-09-13T09:47:42+02:00
CVE-2026-90616/flatpak assigned

- - - - -


2 changed files:

- data/CVE/list
- data/DSA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -10,8 +10,6 @@ CVE-2026-90648 (wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape
 	TODO: check
 CVE-2026-90647 (ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on W ...)
 	TODO: check
-CVE-2026-90616 (In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitra ...)
-	TODO: check
 CVE-2026-90499 (A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This af ...)
 	TODO: check
 CVE-2026-90498 (A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by  ...)
@@ -41712,9 +41710,8 @@ CVE-2026-71193 (In OpenStack Designate before 22.0.1, zone creation checks (_is_
 	- designate 1:22.0.0-2 (bug #1144145)
 	NOTE: https://bugs.launchpad.net/designate/+bug/2160533
 	NOTE: https://security.openstack.org/ossa/OSSA-2026-034.html
-CVE-2026-XXXX [GHSA-8688-9x26-hhxj]
+CVE-2026-90616 [GHSA-8688-9x26-hhxj]
 	- flatpak 1.18.1-1 (bug #1144130)
-	[trixie] - flatpak 1.16.6-1~deb13u2
 	NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj
 	NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/478072972056d2d15c768c246f80abdf83cf0e5e (1.18.1)
 	NOTE: Additional tests: https://github.com/flatpak/flatpak/commit/9d26ea5f1e7c8fb43225668a96289d15c62ad6cd (1.18.1)


=====================================
data/DSA/list
=====================================
@@ -188,6 +188,7 @@
 [12 Aug 2026] DSA-6433-1 xdg-dbus-proxy - security update
 	[trixie] - xdg-dbus-proxy 0.1.6-1+deb13u2
 [12 Aug 2026] DSA-6432-1 flatpak - security update
+	{CVE-2026-90616}
 	[trixie] - flatpak 1.16.6-1~deb13u2
 [11 Aug 2026] DSA-6431-1 openjdk-25 - security update
 	{CVE-2026-41254 CVE-2026-46917 CVE-2026-46968 CVE-2026-47010 CVE-2026-47021 CVE-2026-47027 CVE-2026-47059 CVE-2026-47063 CVE-2026-60147}



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/948570dfda6e88c77a9eeabde2b0f22a35c8e58e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/948570dfda6e88c77a9eeabde2b0f22a35c8e58e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260913/ae710b0e/attachment-0001.htm>