Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak | 0:1.12.7-5.el9_2.5 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak-debuginfo | 0:1.12.7-5.el9_2.5 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak-debugsource | 0:1.12.7-5.el9_2.5 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak-libs | 0:1.12.7-5.el9_2.5 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak-libs-debuginfo | 0:1.12.7-5.el9_2.5 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak-selinux | 0:1.12.7-5.el9_2.5 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak-session-helper | 0:1.12.7-5.el9_2.5 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak-session-helper-debuginfo | 0:1.12.7-5.el9_2.5 |
| Red Hat · RHEL 9.2 E4S rhel_e4s:9.2::appstream | flatpak-tests-debuginfo | 0:1.12.7-5.el9_2.5 |
Vulnerabilities 4
-
High 8.8
Flatpak: flatpak: arbitrary write access as root via extra-data extraction
A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path o…
-
High 7.5
Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer…
-
High 7.4
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, wh…
-
High 7.4
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unpriv…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2532613
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539416
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539419
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539569
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_92369.json
-
report
https://access.redhat.com/security/cve/CVE-2026-90616
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-90616
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-90616
-
article
https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj
-
article
https://www.openwall.com/lists/oss-security/2026/08/11/9
-
report
https://access.redhat.com/security/cve/CVE-2026-96275
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-96275
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-96275
-
article
https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg
-
report
https://access.redhat.com/security/cve/CVE-2026-96280
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-96280
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-96280
-
article
https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc
-
report
https://access.redhat.com/security/cve/CVE-2026-96808
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-96808
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-96808
-
article
https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp