-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 28 Sep 2026 14:10:44 +0100 Source: flatpak Architecture: source Version: 1.18.4-1 Distribution: unstable Urgency: high Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1149218 Changes: flatpak (1.18.4-1) unstable; urgency=high . * New upstream security fix release (Closes: #1149218) - Fix two related symlink traversal vulnerabilities to prevent arbitrary file deletion and limited file overwriting outside the deploy directory, and harden related code paths against symlink traversal (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54) (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf) - Don't write authentication token to disk when using OCI remotes (CVE-2026-97025, GHSA-7rvf-rqr3-43j4) - Restrict permissions of temporary directories /var/tmp/flatpak-cache-* (CVE-2026-97026, GHSA-r9w3-qx54-qvc8) - Filter D-Bus .service files and freedesktop.org .desktop files with an allowlist to prevent denial of service and possibly sandbox escape (CVE-2026-97027, GHSA-v64f-hrwr-j4vh) - Prevent sandboxed processes from killing a parent process outside the sandbox (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2) Checksums-Sha1: 967772d60a4df907b967ed12d82221a70a957836 4054 flatpak_1.18.4-1.dsc 645233c14269778626bb877ea0816c7e34f01326 1363232 flatpak_1.18.4.orig.tar.xz 096aa4bf12b1a0cfd8e9146768cc7c06ff5815a3 44348 flatpak_1.18.4-1.debian.tar.xz 633323fae0dcaec032c9639c582bf012c00a7f76 4471020 flatpak_1.18.4-1.git.tar.xz 5246a7780895cf5d960d147997b791ad55376a5f 17728 flatpak_1.18.4-1_source.buildinfo Checksums-Sha256: 06a57f749603be0c70aea4e096c8370f4dc20a6c8c1f0c140d1b7d2d2e9982d2 4054 flatpak_1.18.4-1.dsc b899a7a00c48d2c626cb8ec33fe556720b376c25805d7222430c0fdca4c6ac8d 1363232 flatpak_1.18.4.orig.tar.xz 9c9ff4be6c5e038b3829ace710baa0480452f299504d7b1c9ea653f96ee354b9 44348 flatpak_1.18.4-1.debian.tar.xz 6b7ccbd0a3c874d825ae9280bd03255bd7ed459b04d16d57358de334ecc92151 4471020 flatpak_1.18.4-1.git.tar.xz b56a313cd736a826be6d07f3dab488d94394bc242c22a105759a8de364f320ca 17728 flatpak_1.18.4-1_source.buildinfo Files: f3a7aeb93563e902bbb86d987dcfbdc1 4054 admin optional flatpak_1.18.4-1.dsc 70b21dc1d5e7672fd7b64bc645d74fbc 1363232 admin optional flatpak_1.18.4.orig.tar.xz a0c78c02ee3e109725a9ddf0a686068d 44348 admin optional flatpak_1.18.4-1.debian.tar.xz cbd5284db4f1ab9cdddaba3df3290476 4471020 admin None flatpak_1.18.4-1.git.tar.xz 263f8468de4b8bb768d759caedfaba1e 17728 admin optional flatpak_1.18.4-1_source.buildinfo Git-Tag-Info: tag=83af0460a22a7c14fbb9a8753adf61346f5c2f81 fp=7a073ad1ae694fa25bff62e5235c099d3eb33076 Git-Tag-Tagger: Simon McVittie <smcv@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmq6Z/MACgkQYG0ITkaD wHnfaBAA6MKbi916G052dA351W0pNDvezTaT5ev6dzFpgYEDIBImFPXJ+vdBpdAt I4aqLR6L1oWgPyaYiWtXEyOxWfXAslsRSYJ5lKogwC4Ei890hEyekDPSAp7rdcsn EbYPNS1utjLYNnnU8NTwkfQ4VAhTABoJbXMerUHFOEDPC1EXBtrbFbPrSoxz2AjE 2hKwSpcPUsV3IEKEI/oRP7jqBTaV2ujIkeCVVxDOO6tDZ3V50IYgCtXvCeMoxmf/ Ubfw9l5mnOksm8HZTniE5NG7Mm0OIzzpow7Hghe+9Ggcd1OPv3cM9KVAPlqp8iUk CLJtCSJV9iDuH+3+9EYYXI8/CZgdVNFJOdlzdLeRwU1gTPY/YFwLy5KtXjbUC366 PtkyVTiOq5x5gbVxtKx3JkXtL9pDgWyDzzc2t9Tce5GPBFuYc//HhXRje6BPJv6s 6Bkusd4lbxVroeJuU3SGeqeaz4W9YGrIoxkChxU+iS7tjvokC7uzqZLsOkG0HUws HajmhK8d3pVU+SaksCQmgVtmkJwoulf0d4xUNnYAKp6MalduhPs8ihHo+RleDP04 xWcnFZZBBRPXz8Sux4fKiHVoLt6qw9gQ1DSCWgkwF8s9KkjOB7xrUCjDTaMx/t6M Sm589KojvUUMJjrAJQDVUbQ4d8uit6X8SZBjCtNWMmZ8yOwSLHg= =lUkg -----END PGP SIGNATURE-----
