-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Thu, 21 Jan 2021 13:57:39 +0000 Source: flatpak Architecture: source Version: 1.2.5-0+deb10u3 Distribution: buster-security Urgency: medium Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 980323 Changes: flatpak (1.2.5-0+deb10u3) buster-security; urgency=medium . * Fix regressions in DSA 4830-1 - Add patch from upstream to fix a regression in 'flatpak build'. The patches to resolve CVE-2021-21261 caused a regression in which 'flatpak build' wouldn't set the LD_LIBRARY_PATH that it should. (Closes: #980323) - Add a patch from upstream to fix possible regressions in extra-data. The extra-data mechanism, used to download large or proprietary components out-of-band, could suffer from a regression similar to #980323 if the app or runtime's apply_extra entry point relies on LD_LIBRARY_PATH. * Add CVE-2021-21261 reference to previous changelog entry Checksums-Sha1: 6e74a17fde951d0cc449b1b1a252b98131e38f0b 3362 flatpak_1.2.5-0+deb10u3.dsc 9e0971814229ebb5d459ab6b8b47da9267a8c913 35080 flatpak_1.2.5-0+deb10u3.debian.tar.xz 0cb7caef1e3e7d9e7af92aafb8b02dcd45071a83 12701 flatpak_1.2.5-0+deb10u3_source.buildinfo Checksums-Sha256: 49a6cb953ffae1fbe97d5b0ce66a2a76dd6f71ee0fcacfe33830542df9b62c73 3362 flatpak_1.2.5-0+deb10u3.dsc e65ee718b30ae4da5f767af0bda3e2f64feb00403d51e0161c1a32888ea1159e 35080 flatpak_1.2.5-0+deb10u3.debian.tar.xz 3622e8561581607e8b9888c4655464689702a95074ec81dc19d30a688abfc1e1 12701 flatpak_1.2.5-0+deb10u3_source.buildinfo Files: 877b335812934cf48ce1d67c14cc968c 3362 admin optional flatpak_1.2.5-0+deb10u3.dsc 6fd3ac87beab2229a0b86ef6aa0c0568 35080 admin optional flatpak_1.2.5-0+deb10u3.debian.tar.xz 4ea652fdef7026b5f491abda40ec5aad 12701 admin optional flatpak_1.2.5-0+deb10u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEENuxaZEik9e95vv6Y4FrhR4+BTE8FAmAKplMACgkQ4FrhR4+B TE9miQ//VrkPZhbdT6ztPAxS/dHVHtiL9AATqm1+nifsmRaIuvCe+4DdorgoOQuC ZDga9W1WmNY6EZ+Mz8wd+ff3vuUSscKRhfsE148DhI/NyVBrkPWAMWTTjRdUUOTr EpFeMwTzI47dPSyArv8AZUOb6g3sI5mNmmEisHfu+2PM78fTrLqoWcTaNg5grSzU wedhHn6vnFs8LjyM7XXB0m7/8IQ0ffpDui23GuUH41vxvS/s/GKbfgDGthpui28b wZfECDDNcV6u5UCyA4W3vwwXZhEQsBlgBDREohJKx3HMKTLXQgZqGYkenR2Xv5Wh KKjRz8QJDHeJPE2XnBk3yfNz1uk8qmFsHlBLqjGgEpQjju/jtkuqbm0a79Bj68nW jXYwbr5uuHF+aMol5Y9+S5crre5Qgg70koaw99zwAL4iv22XI87i4eXO08woIZsc RuPfek0MekcJfi21nq2RDWdW5iNvxCvgMnL5XcA1pE/lQRd7yGkU+cUbdZDqhhMN zCErPt3T+qIdy6/2O0jPlpuEzVaA/IHaV3Zb2D4NFc2aUB19DIZafHzZBmeNZQ5l L8ZyXEwwds3nx745lOdBhxTkGBADoRuSbQ9Y44BelP5XTIdZM1iezHmD7dRpHCno fPeOlgWY9ELi1uK3hMFIJ+6LUJ1h6ar50sYzJ5jn10kfzYm+uEE= =qjN6 -----END PGP SIGNATURE-----
