{"id":"CVE-2026-96807","aliases":["CLSA-2026-1791735057","CLSA-2026-1791819150","DEBIAN-CVE-2026-96807","EUVD-2026-85423","GHSA-99wv-m8rp-g58x","OESA-2026-4570","SUSE-SU-2026:4610-1","SUSE-SU-2026:4944-1","SUSE-SU-2026:5127-1","UBUNTU-CVE-2026-96807"],"status":"published","title":"flatpak: Fix of CVE-2026-96807","description":"In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00118,"percentile":0.01729,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-61"],"published":"2026-09-23T16:54:16Z","modified":"2026-11-07T11:30:04Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak","fixed_in":["1.12.9-4.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-devel","fixed_in":["1.12.9-4.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-libs","fixed_in":["1.12.9-4.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-selinux","fixed_in":["1.12.9-4.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-session-helper","fixed_in":["1.12.9-4.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-tests","fixed_in":["1.12.9-4.el9_6.tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak","fixed_in":["1.12.7-2.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-devel","fixed_in":["1.12.7-2.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-libs","fixed_in":["1.12.7-2.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-selinux","fixed_in":["1.12.7-2.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-session-helper","fixed_in":["1.12.7-2.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-tests","fixed_in":["1.12.7-2.el9_2.tuxcare.els9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.16.6-1~deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.18.1-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"flatpak","fixed_in":["1.10.2-16.oe2403sp1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"flatpak-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-4.el9_6.tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9_2.tuxcare.els9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.10-1","1.14.10-1~deb12u1","1.14.10-1~deb12u2","1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1","1.15.0-1","1.15.0-2","1.15.1-1","1.15.10-1","1.15.12-1","1.15.2-1","1.15.3-1","1.15.4-1","1.15.6-1","1.15.7-1","1.15.8-1","1.15.9-1","1.15.91-1","1.16.0-1","1.16.0-2","1.16.0-2~bpo12+1","1.16.1-1","1.16.1-1~bpo12+1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1","1.18.1-1","1.18.2-1","1.18.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-1~deb13u2"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1"]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1-1"}]}],"versions":["1.16.1-1","1.16.1-2","1.16.1-3","1.16.2-1","1.16.2-1~deb13u1","1.16.3-1","1.16.3-1~deb13u1","1.16.4-1","1.16.4-2","1.16.5-1","1.16.6-1","1.16.6-1~deb13u1","1.16.6-1~deb13u1~bpo12+1","1.16.6-1~deb13u2","1.17.2-1","1.17.3-1","1.17.3-2","1.17.6-1","1.18.0-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-16.oe2403sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.15.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4","1.0.9-0ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4","1.6.5-0ubuntu0.5","1.6.5-0ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1","1.12.7-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1","1.14.6-1ubuntu0.1","1.14.6-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.1-2ubuntu1","1.16.1-3ubuntu1","1.16.2-1","1.16.3-1","1.16.3-1build1","1.16.4-1","1.16.4-2","1.16.6-1"]}],"products":[{"vendor":"flatpak","product":"flatpak"}],"references":[{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x","tags":["advisory","report"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1791735057.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96807","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791819150.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96807.json","tags":["advisory"]},{"url":"https://github.com/flatpak/flatpak","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-96807","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4570","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264610-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1280236","tags":["report"]},{"url":"https://bugzilla.suse.com/1282514","tags":["report"]},{"url":"https://bugzilla.suse.com/1282515","tags":["report"]},{"url":"https://bugzilla.suse.com/1282516","tags":["report"]},{"url":"https://bugzilla.suse.com/1282519","tags":["report"]},{"url":"https://bugzilla.suse.com/1282520","tags":["report"]},{"url":"https://bugzilla.suse.com/1282521","tags":["report"]},{"url":"https://bugzilla.suse.com/1282523","tags":["report"]},{"url":"https://bugzilla.suse.com/1282524","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-90616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96808","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264944-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1282518","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96280","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265127-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261769","tags":["report"]},{"url":"https://bugzilla.suse.com/1261770","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34079","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-96807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96807","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-96807","description":"In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.","status":"published","published":"2026-09-23T16:54:16.931Z","modified":"2026-09-26T22:51:21.873Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:20:00.511569Z"}],"euvd":[{"id":"EUVD-2026-85423","description":"In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.","status":"published","published":"2026-09-23T16:54:16Z","modified":"2026-09-26T22:51:21Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:27:54.286776Z"}],"nvd":[{"id":"CVE-2026-96807","description":"In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.","status":"published","published":"2026-09-23T17:17:25.703Z","modified":"2026-09-26T23:16:42.38Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-96807","description":"In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.","status":"published","published":"2026-09-23T16:54:16.931Z","modified":"2026-11-07T11:41:57.766627422Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-61"],"updated_at":"2026-11-07T12:16:09.040155Z"},{"id":"DEBIAN-CVE-2026-96807","description":"In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.","status":"published","published":"2026-09-23T17:17:25.703Z","modified":"2026-09-27T08:47:31.464882909Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"OESA-2026-4570","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\n\nIn Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.(CVE-2026-96807)","status":"published","published":"2026-10-29T09:03:04Z","modified":"2026-10-29T09:15:30.230952903Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"UBUNTU-CVE-2026-96807","description":"In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.","status":"published","published":"2026-09-23T17:17:00Z","modified":"2026-09-30T21:39:34Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"CLSA-2026-1791735057","title":"flatpak: Fix of CVE-2026-96807","description":"- CVE-2026-96807: regenerate_ld_cache() created and bind-mounted the\n  per-app .ld.so directory by path, and flatpak_switch_symlink_and_remove()\n  swapped its \"active\" symlink with path-based symlink()/rename()/unlink(),\n  so a sandboxed app could replace ~/.var/app/$APPID/.ld.so with a symlink\n  and have ld.so cache files written at an arbitrary host location;\n  regenerate_ld_cache() now opens the directory with\n  glnx_chase_and_mkdirat(), works on it with *at() syscalls and passes it\n  to bwrap with --bind-fd, and flatpak_switch_symlink_and_remove() takes\n  the directory fd and uses symlinkat()/renameat()/unlinkat()\n- Fix flatpak_switch_symlink_and_remove() returning -1 (truthy) instead of\n  FALSE on one error path","status":"published","published":"2026-10-11T16:11:07Z","modified":"2026-10-26T09:31:36.693513639Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791819150","title":"flatpak: Fix of CVE-2026-96807","description":"- CVE-2026-96807: harden regenerate_ld_cache and flatpak_switch_symlink_and_remove\n  against .ld.so symlink attacks by using fd-based operations and bwrap --bind-fd","status":"published","published":"2026-10-12T18:34:51Z","modified":"2026-10-26T09:30:48.511091308Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"SUSE-SU-2026:4610-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96283: flatpak-system-helper: cross-user `CancelPull` orphans another user's ongoing pull (bsc#1282521).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n","status":"published","published":"2026-10-09T15:55:00Z","modified":"2026-10-10T09:30:06.446561391Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4944-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including openh264.\n + Fix unusable sandbox-expose paths affecting Epiphany.\n + Fix installed tests and handling of file descriptor arguments.\n- Changes from version 1.16.5:\n + Fix regressions from the sandbox escape security fix affecting\n browsers, browser-based apps and Steam.\n + Expand test coverage of flatpak-run features used by the portal.\n- Changes from version 1.16.4:\n + Prevent arbitrary file reads in the system-helper context\n (GHSA-2fxp-43j9-pwvc).\n + Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).\n- Changes from version 1.16.3:\n + Be selective about mapping font-dirs.xml in flatpak build.\n- Changes from version 1.16.2:\n + Support reinstalling bundle installations and Intel Xe VA-API.\n + Add cancellation support for curl downloads.\n + Fix font configuration, mask and pin configuration reloads,\n unintended home directory access, flatpak kill, OCI support,\n memory leaks and crashes.\n- Changes from version 1.16.1:\n + Allow updating existing apps under parental controls by default.\n + Use instance IDs for systemd scopes and include /dev/udmabuf\n with --device=dri.\n + Speed up prune --dry-run and permission-reset.\n + Support TLS certificates in /etc/containers/certs.d for OCI.\n + Fix portal crashes, sandbox environment handling, accessibility\n bus discovery, error reporting and shell completion.\n + Update documentation and translations.\n","status":"published","published":"2026-10-29T16:29:47Z","modified":"2026-10-31T18:00:03.939717669Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:5127-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).\n- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including OpenH264.\n + Ignore unusable sandbox-expose paths for portal sub-sandboxes,\n fixing Epiphany regressions.\n + Fix installed tests and handling of standard file descriptors\n passed as invalid flatpak run arguments.\n- Switch from Autotools to Meson, preserving system bubblewrap,\n xdg-dbus-proxy, curl and distribution-specific installation paths.\n- Require bubblewrap \u003e= 0.10.0 and GPGME \u003e= 1.8.0; add Meson,\n gettext, gtk-doc and polkit-agent build dependencies and drop\n obsolete intltool and libelf build dependencies.\n- Generate the system-user pre-script from the Meson build directory\n and package the tmpfiles configuration and renamed manual pages.\n","status":"published","published":"2026-11-06T08:27:38Z","modified":"2026-11-07T11:30:04.13853174Z","updated_at":"2026-11-07T11:45:54.882758Z"}]}}