Summary
[1.16.0-9.4]
- Avoid symlink path traversal in revokefs writer (CVE-2026-96808)
Resolves: RHEL-267891
- Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275)
Resolves: RHEL-267432
- Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280)
Resolves: RHEL-271519
[1.16.0-9.3]
- Align backport with the other branches
Resolves: RHEL-258970
[1.16.0-9.2]
- Harden data dir and var setup against symlink attacks
Resolves: RHEL-258970
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | flatpak | 0:1.16.0-9.el10_2.4 |
| Oracle Linux · 10 | flatpak-devel | 0:1.16.0-9.el10_2.4 |
| Oracle Linux · 10 | flatpak-libs | 0:1.16.0-9.el10_2.4 |
| Oracle Linux · 10 | flatpak-selinux | 0:1.16.0-9.el10_2.4 |
| Oracle Linux · 10 | flatpak-session-helper | 0:1.16.0-9.el10_2.4 |
Vulnerabilities 4
-
High 8.8
Flatpak: flatpak: arbitrary write access as root via extra-data extraction
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path o…
-
High 7.5
Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer…
-
High 7.4
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, wh…
-
High 7.4
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unpriv…