From foo@bar Tue Aug 11 15:20:01 2026 Format: 1.8 Date: Tue, 11 Aug 2026 14:02:52 +0100 Source: flatpak Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym Architecture: sparc64 Version: 1.18.1-1 Distribution: sid Urgency: high Maintainer: sparc64 Build Daemon (landau) Changed-By: Simon McVittie Description: flatpak - Application deployment framework for desktop apps flatpak-tests - Application deployment framework for desktop apps (tests) gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection) libflatpak-dev - Application deployment framework for desktop apps (development) libflatpak0 - Application deployment framework for desktop apps (library) Closes: 1144130 Changes: flatpak (1.18.1-1) unstable; urgency=high . * New upstream security fix release (Closes: #1144130) - GHSA-fqx6-vh4p-42cg: Fix writing outside installation directory via crafted commit metadata. A malicious or compromised Flatpak repository could write attacker-controlled files outside /var/lib/flatpak as root. - GHSA-qrwq-7qwx-q9rp: Fix local privilege escalation involving revokefs. A malicious local user could write files outside /var/lib/flatpak as root by tampering with OSTree objects after signature verification. - GHSA-8688-9x26-hhxj: Fix a sandbox escape involving directories inside ~/.var/app/APP_ID. A malicious or compromised Flatpak app could write to arbitrary files outside its sandbox. - GHSA-99wv-m8rp-g58x: Fix a sandbox escape involving the ld.so cache. A malicious or compromised Flatpak app could write files with a fixed name and limited control over content outside the sandbox. - GHSA-v2gw-v9h5-9q4x: Fix local privilege escalation involving crafted OCI architecture names. A malicious local user on a system with an OCI remote configured (unusual on non-Fedora systems) could trick the flatpak-system-helper process into writing outside /var/lib/flatpak. - GHSA-w69g-9x8j-7p8f: Fix reading outside sandbox involving crafted extension metadata. A malicious or compromised Flatpak app could find out whether specific files exist outside the sandbox. - GHSA-q4gr-vc25-57m5: Fix anti-downgrade checks for components installed system-wide. A malicious local user with an active local login session could downgrade an app, runtime or extension to an older, known-vulnerable version and use this to attack other local users. - GHSA-8qxj-x646-phcm: Fix writing outside working directory in `flatpak build-init`. A malicious or compromised SDK could write outside the intended working directory when a developer starts using it for a build. - GHSA-jr92-2v97-wgvc: Fix a buffer overflow when installing or updating from a malicious OCI registry, not believed to be practically exploitable on 64-bit systems. - GHSA-r7hp-698j-2h6c: Correct xdg-dbus-proxy rules for receiving selected AT-SPI broadcasts so that GTK accessibility features work as intended. Previously, these accessibility features only worked accidentally as a result of an xdg-dbus-proxy security issue, fixed in 0.1.8. - Numerous non-security-related bug fixes Checksums-Sha1: 1b10e307e4be20c934b9851943aee2d7f4566a65 7671768 flatpak-dbgsym_1.18.1-1_sparc64.deb 05f170875e43f5b66f8bcd682f593948e5272354 11088824 flatpak-tests-dbgsym_1.18.1-1_sparc64.deb 8ba0f988bdb6e79e3243e8a490af6bf2ac300f5e 1144344 flatpak-tests_1.18.1-1_sparc64.deb 84caf94b27cfc7784c43d3ddf392bb6e63a2e753 15350 flatpak_1.18.1-1_sparc64.buildinfo f197b3bd82c8f8b318ea69176df6eaa3b4427be9 1437580 flatpak_1.18.1-1_sparc64.deb c7baed6673a76545aa4b748875c50499486c7f38 18972 gir1.2-flatpak-1.0_1.18.1-1_sparc64.deb 5375bd4dd85ae76876381dc8471d8693240011eb 64212 libflatpak-dev_1.18.1-1_sparc64.deb e147b201809a349de783b58057d08218bd3922d1 1756988 libflatpak0-dbgsym_1.18.1-1_sparc64.deb 8efdaadc0b956283a1e3a9144abfe2a920ebb718 311560 libflatpak0_1.18.1-1_sparc64.deb Checksums-Sha256: 8c783747022d8ba745a420613e2c4175fcbfe6d36c43fb3bad12d5ff25acf566 7671768 flatpak-dbgsym_1.18.1-1_sparc64.deb 3c4865559ebe1b0a1d7846d25fbd95cfaa1a0ea60c6fee7e40afd4f08b2f8944 11088824 flatpak-tests-dbgsym_1.18.1-1_sparc64.deb e03a9190cffbaf8482ab06b4623a8e6efc38ea8d0ae9a5afe8147f05ed5461c3 1144344 flatpak-tests_1.18.1-1_sparc64.deb 7075456360cebc04ae2063439896cb89545c060c1e0c95f46a9bec0ef36f4217 15350 flatpak_1.18.1-1_sparc64.buildinfo cf7f7cc9242e274bae644e1814d2b30794853065b4a188d1052d8a0bd7ca3674 1437580 flatpak_1.18.1-1_sparc64.deb e867d5e5eecf0cee6f502631f5a6f54f1b4276ede82c74124cf45202034b1163 18972 gir1.2-flatpak-1.0_1.18.1-1_sparc64.deb 002468829cfb0f9fa5a2e0d6d37f80209b55e2a805912b694ca92ce735ae05f1 64212 libflatpak-dev_1.18.1-1_sparc64.deb f19d07c507a2eee5beaf3b30246fa0ecb3d691122005f8df5724802309f005b5 1756988 libflatpak0-dbgsym_1.18.1-1_sparc64.deb c66a29fc818d3c5749f010a2e3edfb7654e98b2c01a38ca169b40164c0346717 311560 libflatpak0_1.18.1-1_sparc64.deb Files: 729cdfde42372bb68fcd025b01507e2a 7671768 debug optional flatpak-dbgsym_1.18.1-1_sparc64.deb 4b0b98f719ad84bc2be46e7e83198d82 11088824 debug optional flatpak-tests-dbgsym_1.18.1-1_sparc64.deb 2ca8226fbbaa764f6db5278b24253812 1144344 misc optional flatpak-tests_1.18.1-1_sparc64.deb 3e5f02d71bb0d887f491db011e9f0e74 15350 admin optional flatpak_1.18.1-1_sparc64.buildinfo d27444ad03524c6026aa331531c8947a 1437580 admin optional flatpak_1.18.1-1_sparc64.deb 075c3a637888f9cfafaf3645d84a51db 18972 introspection optional gir1.2-flatpak-1.0_1.18.1-1_sparc64.deb 96b97d86e3ae568180051b3310093ac6 64212 libdevel optional libflatpak-dev_1.18.1-1_sparc64.deb 82768ab10bac4c6e4c2e054bd99d5ab5 1756988 debug optional libflatpak0-dbgsym_1.18.1-1_sparc64.deb e48ad32018d4c7830446fa370214cc43 311560 libs optional libflatpak0_1.18.1-1_sparc64.deb Signed-By: Debian buildd autosigning key for landau