Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
8cfe41f7 by Moritz Muehlenhoff at 2026-09-23T08:58:19+02:00
two other flatpak issues CVEfied
- - - - -
2 changed files:
- data/CVE/list
- data/DSA/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -151250,15 +151250,11 @@ CVE-2026-39860 (Nix is a package manager for Linux
and other Unix systems. A bug
NOTE: Fixed by:
https://github.com/NixOS/nix/commit/2f13ee6dc4ade1d919c14757891d5d8a1001eee8
(2.34.5)
NOTE: CVE exists for guix because the fix for CVE-2024-27297 introduces
the issue.
TODO: check, potentially affecting guix if same issue in backporting
fix for CVE-2024-2729
-CVE-2026-XXXX [GHSA-2fxp-43j9-pwvc: Arbitrary read-access to files readable by
_flatpak user]
+CVE-2026-96284 [GHSA-2fxp-43j9-pwvc: Arbitrary read-access to files readable
by _flatpak user]
- flatpak 1.16.4-1 (bug #1132946)
- [trixie] - flatpak 1.16.6-1~deb13u1
- [bookworm] - flatpak 1.14.10-1~deb12u2
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-2fxp-43j9-pwvc
-CVE-2026-XXXX [GHSA-89xm-3m96-w3jg: cross-user CancelPull orphans another
user's ongoing pull]
+CVE-2026-96283 [GHSA-89xm-3m96-w3jg: cross-user CancelPull orphans another
user's ongoing pull]
- flatpak 1.16.4-1 (bug #1132945)
- [trixie] - flatpak 1.16.6-1~deb13u1
- [bookworm] - flatpak 1.14.10-1~deb12u2
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-89xm-3m96-w3jg
CVE-2026-34079 (Flatpak is a Linux application sandboxing and distribution
framework. ...)
{DSA-6223-1 DSA-6207-1}
=====================================
data/DSA/list
=====================================
@@ -919,7 +919,7 @@
{CVE-2026-34080}
[bookworm] - xdg-dbus-proxy 0.1.4-3+deb12u1
[22 Apr 2026] DSA-6223-1 flatpak - security update
- {CVE-2026-34078 CVE-2026-34079}
+ {CVE-2026-34078 CVE-2026-34079 CVE-2026-96284 CVE-2026-96283}
[bookworm] - flatpak 1.14.10-1~deb12u2
[21 Apr 2026] DSA-6222-1 ngtcp2 - security update
{CVE-2026-40170}
@@ -977,7 +977,7 @@
[bookworm] - mediawiki 1:1.39.17-1+deb12u2
[trixie] - mediawiki 1:1.43.8+dfsg-1~deb13u1
[12 Apr 2026] DSA-6207-1 flatpak - security update
- {CVE-2026-34078 CVE-2026-34079}
+ {CVE-2026-34078 CVE-2026-34079 CVE-2026-96284}
[trixie] - flatpak 1.16.6-1~deb13u1
[11 Apr 2026] DSA-6206-1 gdk-pixbuf - security update
{CVE-2026-5201}
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cfe41f795cbdc44f504be0959bd3c696e4f39f3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cfe41f795cbdc44f504be0959bd3c696e4f39f3
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
