[Git][security-tracker-team/security-tracker][master] Two more CVEs allocated for flatpak issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cd5217c9 by Salvatore Bonaccorso at 2026-09-23T20:57:30+02:00
Two more CVEs allocated for flatpak issues

- - - - -


2 changed files:

- data/CVE/list
- data/DSA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -57087,9 +57087,8 @@ CVE-2026-90616 (In Flatpak before 1.18.1, a malicious sandboxed app can obtain a
 	NOTE: Additional tests: https://github.com/flatpak/flatpak/commit/f9da73e1e9830e134886be5a50e9de9c382379c4 (branch flatpak-1.16.x)
 	NOTE: Additional requirement: https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1 (branch flatpak-1.16.x)
 	NOTE: Additional requirement: https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1 (branch flatpak-1.16.x)
-CVE-2026-XXXX [GHSA-qrwq-7qwx-q9rp]
+CVE-2026-96808 [GHSA-qrwq-7qwx-q9rp]
 	- flatpak 1.18.1-1 (bug #1144130)
-	[trixie] - flatpak 1.16.6-1~deb13u2
 	NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp
 	NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/a3583bc87d4f86c2794ff879ea56fce95b0b0b5f (1.18.1)
 	NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/b00c7b5073a25bdc34653642de543b5ef6fe0225 (1.18.1)
@@ -57155,9 +57154,8 @@ CVE-2026-96280 [GHSA-jr92-2v97-wgvc]
 	NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/6be548dd3ac780407ff3cc5824eb9d2acb9f406a (branch flatpak-1.16.x)
 	NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/592e8c6704d310e3b6418caff52e0cc85271c8e3 (branch flatpak-1.16.x)
 	NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/a79764d78b29aa592b612061071b2c361bda4f9e (branch flatpak-1.16.x)
-CVE-2026-XXXX [GHSA-99wv-m8rp-g58x]
+CVE-2026-96807 [GHSA-99wv-m8rp-g58x]
 	- flatpak 1.18.1-1 (bug #1144130)
-	[trixie] - flatpak 1.16.6-1~deb13u2
 	NOTE: https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x
 	NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/e13dfeda330625d2fecc3a54672dfd4dc9c83a5c (1.18.1)
 	NOTE: Fixed by: https://github.com/flatpak/flatpak/commit/f6c8fb5fdb3737e2f45068afe12c4bf1d808fd55 (1.18.1)


=====================================
data/DSA/list
=====================================
@@ -230,7 +230,7 @@
 	{CVE-2026-93676}
 	[trixie] - xdg-dbus-proxy 0.1.6-1+deb13u2
 [12 Aug 2026] DSA-6432-1 flatpak - security update
-	{CVE-2026-90616 CVE-2026-92162 CVE-2026-96275 CVE-2026-96276 CVE-2026-96280 CVE-2026-96282 CVE-2026-96281}
+	{CVE-2026-90616 CVE-2026-92162 CVE-2026-96275 CVE-2026-96276 CVE-2026-96280 CVE-2026-96282 CVE-2026-96281 CVE-2026-96807 CVE-2026-96808}
 	[trixie] - flatpak 1.16.6-1~deb13u2
 [11 Aug 2026] DSA-6431-1 openjdk-25 - security update
 	{CVE-2026-41254 CVE-2026-46917 CVE-2026-46968 CVE-2026-47010 CVE-2026-47021 CVE-2026-47027 CVE-2026-47059 CVE-2026-47063 CVE-2026-60147}



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cd5217c911ac1125b94e63bdfcba86908fba6a5a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cd5217c911ac1125b94e63bdfcba86908fba6a5a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260923/d4541f35/attachment.htm>