[Git][security-tracker-team/security-tracker][master] two other flatpak issues CVEfied

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8cfe41f7 by Moritz Muehlenhoff at 2026-09-23T08:58:19+02:00
two other flatpak issues CVEfied

- - - - -


2 changed files:

- data/CVE/list
- data/DSA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -151250,15 +151250,11 @@ CVE-2026-39860 (Nix is a package manager for Linux and other Unix systems. A bug
 	NOTE: Fixed by: https://github.com/NixOS/nix/commit/2f13ee6dc4ade1d919c14757891d5d8a1001eee8 (2.34.5)
 	NOTE: CVE exists for guix because the fix for CVE-2024-27297 introduces the issue.
 	TODO: check, potentially affecting guix if same issue in backporting fix for CVE-2024-2729
-CVE-2026-XXXX [GHSA-2fxp-43j9-pwvc: Arbitrary read-access to files readable by _flatpak user]
+CVE-2026-96284 [GHSA-2fxp-43j9-pwvc: Arbitrary read-access to files readable by _flatpak user]
 	- flatpak 1.16.4-1 (bug #1132946)
-	[trixie] - flatpak 1.16.6-1~deb13u1
-	[bookworm] - flatpak 1.14.10-1~deb12u2
 	NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc
-CVE-2026-XXXX [GHSA-89xm-3m96-w3jg: cross-user CancelPull orphans another user's ongoing pull]
+CVE-2026-96283 [GHSA-89xm-3m96-w3jg: cross-user CancelPull orphans another user's ongoing pull]
 	- flatpak 1.16.4-1 (bug #1132945)
-	[trixie] - flatpak 1.16.6-1~deb13u1
-	[bookworm] - flatpak 1.14.10-1~deb12u2
 	NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg
 CVE-2026-34079 (Flatpak is a Linux application sandboxing and distribution framework.  ...)
 	{DSA-6223-1 DSA-6207-1}


=====================================
data/DSA/list
=====================================
@@ -919,7 +919,7 @@
 	{CVE-2026-34080}
 	[bookworm] - xdg-dbus-proxy 0.1.4-3+deb12u1
 [22 Apr 2026] DSA-6223-1 flatpak - security update
-	{CVE-2026-34078 CVE-2026-34079}
+	{CVE-2026-34078 CVE-2026-34079 CVE-2026-96284 CVE-2026-96283}
 	[bookworm] - flatpak 1.14.10-1~deb12u2
 [21 Apr 2026] DSA-6222-1 ngtcp2 - security update
 	{CVE-2026-40170}
@@ -977,7 +977,7 @@
 	[bookworm] - mediawiki 1:1.39.17-1+deb12u2
 	[trixie] - mediawiki 1:1.43.8+dfsg-1~deb13u1
 [12 Apr 2026] DSA-6207-1 flatpak - security update
-	{CVE-2026-34078 CVE-2026-34079}
+	{CVE-2026-34078 CVE-2026-34079 CVE-2026-96284}
 	[trixie] - flatpak 1.16.6-1~deb13u1
 [11 Apr 2026] DSA-6206-1 gdk-pixbuf - security update
 	{CVE-2026-5201}



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cfe41f795cbdc44f504be0959bd3c696e4f39f3

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cfe41f795cbdc44f504be0959bd3c696e4f39f3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260923/63d16365/attachment.htm>