{"id":"CVE-2026-34079","aliases":["ALPINE-CVE-2026-34079","ALSA-2026:21755","ALSA-2026:21756","ALSA-2026:21757","CLSA-2026-1776949031","CLSA-2026-1777542671","CLSA-2026-1777890711","DEBIAN-CVE-2026-34079","EUVD-2026-19971","GHSA-p29x-r292-46pp","MGASA-2026-0133","OESA-2026-2590","OESA-2026-2591","OESA-2026-2709","OESA-2026-2710","RHSA-2026:21755","RHSA-2026:21756","RHSA-2026:21757","RHSA-2026:23417","RHSA-2026:23418","RHSA-2026:23419","RHSA-2026:23420","RHSA-2026:25068","RHSA-2026:25381","RHSA-2026:30901","RHSA-2026:35843","RLSA-2026:21755","RLSA-2026:21756","RLSA-2026:21757","SUSE-SU-2026:1511-1","SUSE-SU-2026:1541-1","SUSE-SU-2026:1600-1","SUSE-SU-2026:1713-1","SUSE-SU-2026:5127-1","UBUNTU-CVE-2026-34079","USN-8741-1","openSUSE-SU-2026:10541-1"],"status":"published","title":"Flatpak affected by arbitrary file deletion on the host filesystem","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00328,"percentile":0.26138,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-04-07T21:29:44Z","modified":"2026-11-07T11:30:04Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"flatpak","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"flatpak","fixed_in":["1.16.4-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak","fixed_in":["1.12.7-2.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-devel","fixed_in":["1.12.7-2.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-libs","fixed_in":["1.12.7-2.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-selinux","fixed_in":["1.12.7-2.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-session-helper","fixed_in":["1.12.7-2.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-tests","fixed_in":["1.12.7-2.el9.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak","fixed_in":["1.12.9-4.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-devel","fixed_in":["1.12.9-4.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-libs","fixed_in":["1.12.9-4.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-selinux","fixed_in":["1.12.9-4.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-session-helper","fixed_in":["1.12.9-4.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-tests","fixed_in":["1.12.9-4.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"flatpak","fixed_in":["1.0.9-13.el7_9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"flatpak-builder","fixed_in":["1.0.0-13.el7_9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"flatpak-devel","fixed_in":["1.0.9-13.el7_9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"flatpak-libs","fixed_in":["1.0.9-13.el7_9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"flatpak","fixed_in":["1.14.10-1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.16.6-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.16.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","fixed_in":["1.0.9-0ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","fixed_in":["1.6.5-0ubuntu0.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","fixed_in":["1.12.7-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","fixed_in":["1.14.6-1ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.el7_9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-13.el7_9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.el7_9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.el7_9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1~deb12u2"}]}],"versions":["1.14.10-1~deb12u1","1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1~deb13u1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1~deb13u1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-12.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-12.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-14.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-12.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-5.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-1.el8_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-2.el8_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-16.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el7_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el9_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-4.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-9.el10_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-150400.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-150400.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-150400.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-150400.3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150600.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-0ubuntu0.4+esm1"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-0ubuntu0.5+esm1"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4","1.6.5-0ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-1ubuntu0.1+esm1"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-1ubuntu0.1+esm1"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.0-2","1.16.1-1build1","1.16.1-2","1.16.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-0ubuntu0.4+esm1"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-0ubuntu0.5+esm1"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4","1.6.5-0ubuntu0.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-1ubuntu0.1+esm1"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-1ubuntu0.1+esm1"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1.1"}]}],"bundled":2}],"products":[{"vendor":"flatpak","product":"flatpak"}],"references":[{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-p29x-r292-46pp","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","article","report"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-34079","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21755","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34078","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34079","tags":["report"]},{"url":"https://bugzilla.redhat.com/2456276","tags":["report"]},{"url":"https://bugzilla.redhat.com/2456284","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-21755.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21756","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-21756.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21757","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-21757.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1776949031.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777542671.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777890711.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34079","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34079.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34079","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0133.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35336","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/09/3","tags":["web"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-cc2q-qc34-jprg","tags":["advisory","article"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg","tags":["advisory"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00133.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2590","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2591","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2709","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2710","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456284","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21755.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34078","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34079","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21756.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21757.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23417","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23417.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23418","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23418.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23419","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23419.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23420","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23420.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25068","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25068.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25381","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25381.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30901","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30901.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35843","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35843.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21755","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21756","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:21757","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261511-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261769","tags":["report"]},{"url":"https://bugzilla.suse.com/1261770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34079","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261541-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261600-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261713-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265127-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280236","tags":["report"]},{"url":"https://bugzilla.suse.com/1282514","tags":["report"]},{"url":"https://bugzilla.suse.com/1282515","tags":["report"]},{"url":"https://bugzilla.suse.com/1282516","tags":["report"]},{"url":"https://bugzilla.suse.com/1282518","tags":["report"]},{"url":"https://bugzilla.suse.com/1282519","tags":["report"]},{"url":"https://bugzilla.suse.com/1282520","tags":["report"]},{"url":"https://bugzilla.suse.com/1282523","tags":["report"]},{"url":"https://bugzilla.suse.com/1282524","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96808","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-34079","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8741-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34078","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34079","title":"Flatpak affected by arbitrary file deletion on the host filesystem","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.","status":"published","published":"2026-04-07T21:29:44.601Z","modified":"2026-04-10T20:13:47.945Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-19971","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.","status":"published","published":"2026-04-07T21:29:44Z","modified":"2026-04-10T20:13:47Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:24:29.371024Z"}],"nvd":[{"id":"CVE-2026-34079","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.","status":"published","published":"2026-04-07T22:16:22.08Z","modified":"2026-07-24T22:10:00.14Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"ALPINE-CVE-2026-34079","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.","status":"published","published":"2026-04-07T22:16:22.08Z","modified":"2026-11-03T06:32:54.774777065Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-34079","title":"Flatpak affected by arbitrary file deletion on the host filesystem","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.","status":"published","published":"2026-04-07T21:29:44.601Z","modified":"2026-11-07T11:41:57.521316415Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-07T12:16:09.040155Z"},{"id":"DEBIAN-CVE-2026-34079","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.","status":"published","published":"2026-04-07T22:16:22.08Z","modified":"2026-10-01T03:03:04.287923649Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"OESA-2026-2590","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nEvery Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)\n\nFlatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)","status":"published","published":"2026-06-05T11:11:32Z","modified":"2026-08-18T01:20:03.537676028Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2591","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nEvery Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)\n\nFlatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)","status":"published","published":"2026-06-05T11:11:32Z","modified":"2026-08-18T01:20:03.352005365Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2709","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nEvery Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)\n\nFlatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)","status":"published","published":"2026-06-24T11:11:38Z","modified":"2026-08-18T01:20:05.95949557Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2710","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nEvery Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)\n\nFlatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)","status":"published","published":"2026-06-24T11:11:38Z","modified":"2026-08-18T01:20:05.998057016Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:21755","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-05-29T10:11:04Z","modified":"2026-07-06T10:05:34Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21756","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-05-29T10:11:04Z","modified":"2026-07-06T10:05:34Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:21757","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-05-29T10:11:05Z","modified":"2026-07-06T10:05:35Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:23417","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-06-05T10:06:33Z","modified":"2026-07-06T10:05:56Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:23418","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-06-05T10:06:34Z","modified":"2026-07-06T10:05:57Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:23419","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-06-05T10:06:34Z","modified":"2026-07-06T10:05:58Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:23420","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-06-05T10:06:34Z","modified":"2026-07-06T10:05:58Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:25068","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-06-11T10:09:08Z","modified":"2026-07-06T10:06:04Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:25381","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-06-12T10:07:12Z","modified":"2026-07-06T10:06:13Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:30901","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-06-29T11:29:46Z","modified":"2026-07-06T10:07:04Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:35843","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2026-07-06T10:08:04Z","modified":"2026-07-06T10:17:01.601345335Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RLSA-2026:21755","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)\n\n* flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-05T00:03:04.540592Z","modified":"2026-06-05T00:30:19.517679032Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:21756","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)\n\n* flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-29T06:00:50.714518Z","modified":"2026-05-29T06:30:04.819991021Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:21757","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.\n\nSecurity Fix(es):\n\n* flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)\n\n* flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-04T12:04:37.164871Z","modified":"2026-06-04T12:30:17.548956618Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-34079","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps  to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.","status":"published","published":"2026-04-07T22:16:00Z","modified":"2026-09-10T16:30:19.84884349Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:21755","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)\n  * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-28T00:00:00Z","modified":"2026-10-29T11:32:34.021680753Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:21756","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)\n  * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-28T00:00:00Z","modified":"2026-10-29T11:02:23.632713629Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:21757","title":"Important: flatpak security update","description":"Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.  \n\nSecurity Fix(es):  \n\n  * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)\n  * flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-28T00:00:00Z","modified":"2026-10-29T11:30:25.602050561Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"CLSA-2026-1776949031","title":"flatpak: Fix of CVE-2026-34079","description":"- CVE-2026-34079: restrict cached-file removal to alphanumeric targets in\n  flatpak_switch_symlink_and_remove to prevent path-traversal unlink via a\n  sandboxed-app-controlled symlink","status":"published","published":"2026-04-23T12:57:16Z","modified":"2026-06-01T00:32:27.504069566Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777542671","title":"flatpak: Fix of CVE-2026-34079","description":"- CVE-2026-34079: prevent arbitrary file deletion via ld.so cache symlink","status":"published","published":"2026-04-30T09:51:16Z","modified":"2026-06-01T00:32:49.857029629Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777890711","title":"flatpak: Fix of 2 CVEs","description":"- CVE-2026-34079: fix arbitrary host file deletion via app-controlled\n  ld.so cache symlink in flatpak_switch_symlink_and_remove","status":"published","published":"2026-10-20T21:58:37Z","modified":"2026-10-26T09:31:40.839933277Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"MGASA-2026-0133","title":"Updated flatpak packages fix security vulnerabilities","description":"Complete sandbox escape leading to host file access and code execution\nin the host context. (CVE-2026-34078)\nArbitrary file deletion on the host filesystem. (CVE-2026-34079)\n","status":"published","published":"2026-05-14T02:43:25Z","modified":"2026-05-14T02:45:23.10027Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10541-1","title":"flatpak-1.16.6-1.1 on GA media","description":"These are all security issues fixed in the flatpak-1.16.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-14T00:00:00Z","modified":"2026-04-15T08:00:07.081818Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2026:1511-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).\n- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).\n","status":"published","published":"2026-04-21T06:28:50Z","modified":"2026-04-22T08:16:16.250322Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1541-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: improper processing of app-controlled symlinks by sandbox-expose can lead to sandbox escape, host\n  file access and code execution in the host context (bsc#1261769).\n- CVE-2026-34079: improper removal of outdated cache files allows for arbitrary file deletion on the host filesystem\n  (bsc#1261770).\n","status":"published","published":"2026-04-22T07:22:36Z","modified":"2026-04-23T08:45:06.900461Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1600-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).\n- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).\n","status":"published","published":"2026-04-24T11:46:10Z","modified":"2026-04-25T07:45:37.579442Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:1713-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).\n- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).\n","status":"published","published":"2026-05-06T12:06:52Z","modified":"2026-05-07T08:45:51.382726Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:5127-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).\n- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including OpenH264.\n + Ignore unusable sandbox-expose paths for portal sub-sandboxes,\n fixing Epiphany regressions.\n + Fix installed tests and handling of standard file descriptors\n passed as invalid flatpak run arguments.\n- Switch from Autotools to Meson, preserving system bubblewrap,\n xdg-dbus-proxy, curl and distribution-specific installation paths.\n- Require bubblewrap \u003e= 0.10.0 and GPGME \u003e= 1.8.0; add Meson,\n gettext, gtk-doc and polkit-agent build dependencies and drop\n obsolete intltool and libelf build dependencies.\n- Generate the system-user pre-script from the Meson build directory\n and package the tmpfiles configuration and renamed manual pages.\n","status":"published","published":"2026-11-06T08:27:38Z","modified":"2026-11-07T11:30:04.13853174Z","updated_at":"2026-11-07T11:45:54.882758Z"},{"id":"USN-8741-1","title":"flatpak vulnerabilities","description":"It was discovered that Flatpak did not properly validate paths in\nsandbox-expose options. A malicious or compromised Flatpak app could\nuse app-controlled symlinks to access arbitrary host files and gain\ncode execution in the host context. This issue was addressed in Ubuntu\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2026-34078) \n\nIt was discovered that Flatpak did not properly validate paths when   \nremoving outdated ld.so cache files. A malicious or compromised Flatpak\napp could use this issue to delete arbitrary files on the host. \n(CVE-2026-34079)","status":"published","published":"2026-09-10T08:44:18Z","modified":"2026-09-10T16:42:30.390320742Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}