Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8dc540e6 by Carlos Henrique Lima Melara at 2026-08-12T00:44:29-03:00
flatpak: track upstream fixes for 1.18.x and 1.16.x
- - - - -
dd58e9a9 by Salvatore Bonaccorso at 2026-08-12T07:35:55+02:00
Merge branch 'track-flatpak-upstream-fixes' into 'master'
flatpak: track upstream fixes for 1.18.x and 1.16.x
See merge request security-tracker-team/security-tracker!319
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1772,36 +1772,105 @@ CVE-2026-71193
CVE-2026-XXXX [GHSA-8688-9x26-hhxj]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-8688-9x26-hhxj
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/478072972056d2d15c768c246f80abdf83cf0e5e
(1.18.1)
+ NOTE: Additional tests:
https://github.com/flatpak/flatpak/commit/9d26ea5f1e7c8fb43225668a96289d15c62ad6cd
(1.18.1)
+ NOTE: Additional tests:
https://github.com/flatpak/flatpak/commit/01624446aa752184acbe74f9af3b709b7b6728c7
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/afdd4a156549cdfa26d23f2c791e5ed3995fd6da
(branch flatpak-1.16.x)
+ NOTE: Additional tests:
https://github.com/flatpak/flatpak/commit/03a2be6c6844c3ce54c42fca57ffae59cba1a53a
(branch flatpak-1.16.x)
+ NOTE: Additional tests:
https://github.com/flatpak/flatpak/commit/c3c03bfcbad762bd49d9225435bb462899600614
(branch flatpak-1.16.x)
+ NOTE: Additional tests:
https://github.com/flatpak/flatpak/commit/f9da73e1e9830e134886be5a50e9de9c382379c4
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1
(branch flatpak-1.16.x)
CVE-2026-XXXX [GHSA-qrwq-7qwx-q9rp]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/a3583bc87d4f86c2794ff879ea56fce95b0b0b5f
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/b00c7b5073a25bdc34653642de543b5ef6fe0225
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/4ddb5dc0de1bd25e52627f520a49063d94f79377
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/e7f96b4d1533f735ace2ea21dbf770e8d4be465a
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/37fb84ec00005ce3e368f7a5afb9743aedea24a2
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/4d1eb212237069681b1f994e2b5b61e40015050f
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/076f77a4775490b2aef43f4e01eeee9aa965bd21
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/769ad563bae82b948496a7edffa5eb3f71d0cc72
(branch flatpak-1.16.x)
CVE-2026-XXXX [GHSA-fqx6-vh4p-42cg]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/c42326c74d63e550d874312be0c7a800cf5fc39f
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/12a30ecb422b1e1246cb2d9af60c14ef7b8f22a4
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/eef9aaee0d84138b5b0e440f739bf9504757e5a4
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/4266256cd47e2d9b35da59046bc03f2bd4de3a2a
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/e8050164eab924d496a42b44c7145fbecf213993
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/fb8ae524738e0a0097a6d64bfcda71552174b7fb
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/c0a109aa4f861f557aed60c42d0ee64d2c3a943c
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/104c7a63bca482155ace642d59d4765f57f4ecaa
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/c9b4b4946a7fc8d4a79a454a9d70faee5f7af820
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/de3decabfd2bc62a774698342d1a9e8ea98077d7
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1
(branch flatpak-1.16.x)
CVE-2026-XXXX [GHSA-8qxj-x646-phcm]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/c42326c74d63e550d874312be0c7a800cf5fc39f
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/12a30ecb422b1e1246cb2d9af60c14ef7b8f22a4
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/71f28c42ffff7bfd132fbee1ebc50ab0d08de2d3
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/fb8ae524738e0a0097a6d64bfcda71552174b7fb
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/c0a109aa4f861f557aed60c42d0ee64d2c3a943c
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/619e75e7e453697b3f1d50d84e116e4df3d15df6
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1
(branch flatpak-1.16.x)
CVE-2026-XXXX [GHSA-9rww-v4mm-x4jg]
- flatpak 1.18.1-1 (bug #1144130)
[trixie] - flatpak <not-affected> (Vulnerable code not present)
[bookworm] - flatpak <not-affected> (Vulnerable code not present)
[bullseye] - flatpak <not-affected> (Vulnerable code not present)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-9rww-v4mm-x4jg
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/e6fa2f9b416ec382644694c8737dc8fbe7f07b89
(1.18.1)
CVE-2026-XXXX [GHSA-v2gw-v9h5-9q4x]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-v2gw-v9h5-9q4x
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/19456b916842b079af833a86b9ab89c5db154b92
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/01773f84021dd090b2426f79675f94f2564f9279
(1.18.1)
+ NOTE: Additional tests:
https://github.com/flatpak/flatpak/commit/aeb369a2723506fabc1f701ef7a0dc6c97c4b983
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/bb5c9a083641cbb03202c1ce4d7c632eedeadd80
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/3716e0761ece68405d0a49328f7c74cb14f4a245
(branch flatpak-1.16.x)
+ NOTE: Additional tests:
https://github.com/flatpak/flatpak/commit/e52c97fc2f307f695f5db16d8a5ba44b23d1d894
(branch flatpak-1.16.x)
+ NOTE: Test workaround for old meson:
https://github.com/flatpak/flatpak/pull/6768
CVE-2026-XXXX [GHSA-jr92-2v97-wgvc]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/892d261255449d0cd5d97f6a8f2a731e566ff913
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/c52e851f3f5036b132321c19b3c0102aabda9a3a
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/f710ca12a056678822adf346fed9c2139dd498c7
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/6be548dd3ac780407ff3cc5824eb9d2acb9f406a
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/592e8c6704d310e3b6418caff52e0cc85271c8e3
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/a79764d78b29aa592b612061071b2c361bda4f9e
(branch flatpak-1.16.x)
CVE-2026-XXXX [GHSA-99wv-m8rp-g58x]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/e13dfeda330625d2fecc3a54672dfd4dc9c83a5c
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/f6c8fb5fdb3737e2f45068afe12c4bf1d808fd55
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/76c9296b6780ca67f44cf67f0823f086d692a592
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/d902a41b522db3268ab2687de60a93637f39ae12
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/a0f48ed52d004f0a0f093d9fd977a19ea09fea23
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/aa35286d1f8ca5ab04de01560aaef349108cc356
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1
(branch flatpak-1.16.x)
CVE-2026-XXXX [GHSA-w69g-9x8j-7p8f]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-w69g-9x8j-7p8f
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/6ec728c15b4eff47b7d69a2cc22e4aef52011585
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/ad044fc728cffe22dfa78e14c351bfe907f5164f
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/2764862569886360a550491ecd06c89e1b76eb8e
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/e1f2ef83cd7225906078635e3d7561e9bc2cbd5b
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/3d43a0f5fa602cc3edc557d8ab835030140792b1
(branch flatpak-1.16.x)
+ NOTE: Additional requirement:
https://github.com/flatpak/flatpak/commit/68c12b9695eee4a94d896f0cf2f388f0d3c63df1
(branch flatpak-1.16.x)
CVE-2026-XXXX [GHSA-q4gr-vc25-57m5]
- flatpak 1.18.1-1 (bug #1144130)
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-q4gr-vc25-57m5
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/d5939b0f1751df7dede31a1ee7fb5b8dfe49fd79
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/9b990351898b18b48bf4e834bcbc618d270cf8b1
(1.18.1)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/85f241ef6b3784257f0278c4dfbd988355921862
(branch flatpak-1.16.x)
+ NOTE: Fixed by:
https://github.com/flatpak/flatpak/commit/b0f1704b34d2a551c0073a9fc5e918174a97af64
(branch flatpak-1.16.x)
CVE-2026-XXXX [GHSA-r7hp-698j-2h6c: filtering for broadcast messages bypasses
path/interface/member checks]
- xdg-dbus-proxy 0.1.8-1 (bug #1144129)
[bookworm] - xdg-dbus-proxy <not-affected> (Vulnerable code not present)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/3871661a27c6a15e1f4dae3a5aee909e18ffa9aa...dd58e9a9ab228dfddab72c8a59269e3e317f9be6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/3871661a27c6a15e1f4dae3a5aee909e18ffa9aa...dd58e9a9ab228dfddab72c8a59269e3e317f9be6
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
