From foo@bar Tue Aug 11 15:00:01 2026 Format: 1.8 Date: Tue, 11 Aug 2026 14:02:52 +0100 Source: flatpak Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym Architecture: x32 Version: 1.18.1-1 Distribution: sid Urgency: high Maintainer: x32 Build Daemon (x32-do-02) Changed-By: Simon McVittie Description: flatpak - Application deployment framework for desktop apps flatpak-tests - Application deployment framework for desktop apps (tests) gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection) libflatpak-dev - Application deployment framework for desktop apps (development) libflatpak0 - Application deployment framework for desktop apps (library) Closes: 1144130 Changes: flatpak (1.18.1-1) unstable; urgency=high . * New upstream security fix release (Closes: #1144130) - GHSA-fqx6-vh4p-42cg: Fix writing outside installation directory via crafted commit metadata. A malicious or compromised Flatpak repository could write attacker-controlled files outside /var/lib/flatpak as root. - GHSA-qrwq-7qwx-q9rp: Fix local privilege escalation involving revokefs. A malicious local user could write files outside /var/lib/flatpak as root by tampering with OSTree objects after signature verification. - GHSA-8688-9x26-hhxj: Fix a sandbox escape involving directories inside ~/.var/app/APP_ID. A malicious or compromised Flatpak app could write to arbitrary files outside its sandbox. - GHSA-99wv-m8rp-g58x: Fix a sandbox escape involving the ld.so cache. A malicious or compromised Flatpak app could write files with a fixed name and limited control over content outside the sandbox. - GHSA-v2gw-v9h5-9q4x: Fix local privilege escalation involving crafted OCI architecture names. A malicious local user on a system with an OCI remote configured (unusual on non-Fedora systems) could trick the flatpak-system-helper process into writing outside /var/lib/flatpak. - GHSA-w69g-9x8j-7p8f: Fix reading outside sandbox involving crafted extension metadata. A malicious or compromised Flatpak app could find out whether specific files exist outside the sandbox. - GHSA-q4gr-vc25-57m5: Fix anti-downgrade checks for components installed system-wide. A malicious local user with an active local login session could downgrade an app, runtime or extension to an older, known-vulnerable version and use this to attack other local users. - GHSA-8qxj-x646-phcm: Fix writing outside working directory in `flatpak build-init`. A malicious or compromised SDK could write outside the intended working directory when a developer starts using it for a build. - GHSA-jr92-2v97-wgvc: Fix a buffer overflow when installing or updating from a malicious OCI registry, not believed to be practically exploitable on 64-bit systems. - GHSA-r7hp-698j-2h6c: Correct xdg-dbus-proxy rules for receiving selected AT-SPI broadcasts so that GTK accessibility features work as intended. Previously, these accessibility features only worked accidentally as a result of an xdg-dbus-proxy security issue, fixed in 0.1.8. - Numerous non-security-related bug fixes Checksums-Sha1: b0d293528b1e987ecd28ea88a454b949e682c40e 7812212 flatpak-dbgsym_1.18.1-1_x32.deb 71118e9b84f7d2e5af2d1d1d5afc94bd1f691200 11264312 flatpak-tests-dbgsym_1.18.1-1_x32.deb cd157c49ba0ebea9681750e3b3acc2f352d72d3c 1520932 flatpak-tests_1.18.1-1_x32.deb e454fb8388ec94266fe0cad2b46dc4578352b688 15343 flatpak_1.18.1-1_x32.buildinfo 0dbf801ae7922d6a0115b2f2b13d2ca1e28b93d8 1689624 flatpak_1.18.1-1_x32.deb 35db45fd2015ddff44d11bcf02428c172a2f8033 19100 gir1.2-flatpak-1.0_1.18.1-1_x32.deb bac5ea4cc361ca3ff14655642c58baafaf9fd6ca 64212 libflatpak-dev_1.18.1-1_x32.deb 3224ecb528c86c27b0caa2abed17c5295bdf9847 1787136 libflatpak0-dbgsym_1.18.1-1_x32.deb 79b667d08a1865924596152c5b8d9933f24ddad7 421052 libflatpak0_1.18.1-1_x32.deb Checksums-Sha256: 2a2e3a9a2e14a7c8bd36a8c72e0dd5070c5efab99c2a380dad33739e13330ebe 7812212 flatpak-dbgsym_1.18.1-1_x32.deb 30496fd38f4a9a383710a8589d3611cd0ae66105cf187a6e6b73cdf6d5c2d929 11264312 flatpak-tests-dbgsym_1.18.1-1_x32.deb ca0d00c4802e1936460494a80489196a5b38942e0cd689930cf49eb19caf6282 1520932 flatpak-tests_1.18.1-1_x32.deb f37b29312c243479b16a9591cc1328e14ca7f4ab3d9170823bdc76d5a2a50d9c 15343 flatpak_1.18.1-1_x32.buildinfo de8de20258279c6f95d595e0e162bc15f84c206fddd4648392b9a3daeac3262b 1689624 flatpak_1.18.1-1_x32.deb c99c19f8648f18957ecd48c8e56a7b12d36028cb2f6117ef352a7e84fe30c1ac 19100 gir1.2-flatpak-1.0_1.18.1-1_x32.deb 591ba76b387da47c8978e70bfb499db793033932642d6ed553728e7b8ae7b628 64212 libflatpak-dev_1.18.1-1_x32.deb f5708f474e825f34f1cdd003b0a8644f53244eb2de782bb45d679cd9d8cd4747 1787136 libflatpak0-dbgsym_1.18.1-1_x32.deb 5185ccbc99e2bbcfea96638047f65b0cbfec8db853a922c87b14feaa97c8e487 421052 libflatpak0_1.18.1-1_x32.deb Files: 5e93e75328ed62d0887dd9f7699d0bfa 7812212 debug optional flatpak-dbgsym_1.18.1-1_x32.deb b1cb560fdbac9b21479e33e7f117558d 11264312 debug optional flatpak-tests-dbgsym_1.18.1-1_x32.deb 9826a0070fb6f5085c6141b4a628e67c 1520932 misc optional flatpak-tests_1.18.1-1_x32.deb 77a4cc87e23879caea12bd3315838f72 15343 admin optional flatpak_1.18.1-1_x32.buildinfo 098ce3d863bca088f89d77134d36b792 1689624 admin optional flatpak_1.18.1-1_x32.deb 0e6a66c27368407c7c660e9cf93ec18c 19100 introspection optional gir1.2-flatpak-1.0_1.18.1-1_x32.deb 2d4560e500d4361ec0841ca41b5c674d 64212 libdevel optional libflatpak-dev_1.18.1-1_x32.deb d176eaa82770ce2676f8206783c7d776 1787136 debug optional libflatpak0-dbgsym_1.18.1-1_x32.deb 364a8e4e2bfb78968dc9e281e4e5c8da 421052 libs optional libflatpak0_1.18.1-1_x32.deb Signed-By: Debian buildd autosigning key for x32-do-02