ELSA-2026-80497

ELSA-2026-80497 - flatpak security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-11

Description

[1.12.9-4.4]
- Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280)
Resolves: RHEL-271518

[1.12.9-4.3]
- Avoid symlink path traversal in revokefs writer (CVE-2026-96808)
Resolves: RHEL-267902
- Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275)
Resolves: RHEL-267434

[1.12.9-4.2]
- Harden data dir and var setup against symlink attacks
Resolves: RHEL-258975

Related CVEs

CVE-2026-90616

CVE-2026-96275

CVE-2026-96280

CVE-2026-96808

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	flatpak-1.12.9-4.el9_8.4.src.rpm	757edf5ee8ca7e8562d25e29ec6b0c7cdaa0e8109746c39f475586a792393fbf	-	ol9_aarch64_appstream
	flatpak-1.12.9-4.el9_8.4.src.rpm	757edf5ee8ca7e8562d25e29ec6b0c7cdaa0e8109746c39f475586a792393fbf	-	ol9_aarch64_codeready_builder
	flatpak-1.12.9-4.el9_8.4.aarch64.rpm	a1dc7518d365705fea1d766f488d030a81f7d9f61f71abddbedbb122b683164a	-	ol9_aarch64_appstream
	flatpak-devel-1.12.9-4.el9_8.4.aarch64.rpm	bf4affe064de258074727071e4dd6f511e1436e032862afdd60739fb2bef057f	-	ol9_aarch64_codeready_builder
	flatpak-libs-1.12.9-4.el9_8.4.aarch64.rpm	44d132045dd0a57ab982bd71d56482b75aab076d42437a7bd1fd7886e42c3cc9	-	ol9_aarch64_appstream
	flatpak-selinux-1.12.9-4.el9_8.4.noarch.rpm	3c8ac924cdbe63356aef8d1e02686ebe687c90907ea98828429b87ba7eb39ef3	-	ol9_aarch64_appstream
	flatpak-session-helper-1.12.9-4.el9_8.4.aarch64.rpm	cc58cfb9bceb132011f09095938fa7a11111c8ac730f9d8fcf0952d848c0670a	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	flatpak-1.12.9-4.el9_8.4.src.rpm	757edf5ee8ca7e8562d25e29ec6b0c7cdaa0e8109746c39f475586a792393fbf	-	ol9_x86_64_appstream
	flatpak-1.12.9-4.el9_8.4.src.rpm	757edf5ee8ca7e8562d25e29ec6b0c7cdaa0e8109746c39f475586a792393fbf	-	ol9_x86_64_codeready_builder
	flatpak-1.12.9-4.el9_8.4.i686.rpm	82a65ccc3a6e16bedd2bbb266efc03c50142fd9db0b11b7dbc7e1493ecc144ad	-	ol9_x86_64_codeready_builder
	flatpak-1.12.9-4.el9_8.4.x86_64.rpm	1e3952e6ca13c4644532acd5f3cbc2b414a85ccd49b170eb9cebe97d808ca910	-	ol9_x86_64_appstream
	flatpak-devel-1.12.9-4.el9_8.4.i686.rpm	77968b5808e6deee5e2b25c3c7670a74d0ceb8e895014ca1748a69c3e03d938e	-	ol9_x86_64_codeready_builder
	flatpak-devel-1.12.9-4.el9_8.4.x86_64.rpm	dcbd66e8b6dbc9267965d5082d0e9a0ece07328111a247c597e26eae89238041	-	ol9_x86_64_codeready_builder
	flatpak-libs-1.12.9-4.el9_8.4.i686.rpm	74c994d996f65f63611d9d2bf4bf98a217cee2d554afc205db5da2b30b51297e	-	ol9_x86_64_appstream
	flatpak-libs-1.12.9-4.el9_8.4.x86_64.rpm	f16d98f5b947d8f0cb55cc577873211da7789cd93e9b2ce1f8514accd97c1072	-	ol9_x86_64_appstream
	flatpak-selinux-1.12.9-4.el9_8.4.noarch.rpm	3c8ac924cdbe63356aef8d1e02686ebe687c90907ea98828429b87ba7eb39ef3	-	ol9_x86_64_appstream
	flatpak-session-helper-1.12.9-4.el9_8.4.i686.rpm	8a214890cd67a833b28a4888300b1876371a60ac04ced4d4101fc176b336fcb4	-	ol9_x86_64_codeready_builder
	flatpak-session-helper-1.12.9-4.el9_8.4.x86_64.rpm	7ddbca9c988ff50788f5f38ebe6a626177f9e99fa648bc63b3dea206884dcde1	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team