ELSA-2026-80687

ELSA-2026-80687 - flatpak security update

Type:SECURITY
Impact:IMPORTANT
Release Date:2026-10-11

Description


[1.12.9-7]
- Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280)
Resolves: RHEL-271507

[1.12.9-6]
- Avoid symlink path traversal in revokefs writer (CVE-2026-96808)
Resolves: RHEL-267897
- Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275)
Resolves: RHEL-267425

[1.12.9-5]
- Harden data dir and var setup against symlink attacks
Resolves: RHEL-258965


Related CVEs


CVE-2026-90616
CVE-2026-96275
CVE-2026-96280
CVE-2026-96808

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 8 (aarch64) flatpak-1.12.9-7.el8_10.src.rpm1acb142ddc845a998f4630254d625e0a9f57ad274b3cba477e0f49c76d35d153-ol8_aarch64_appstream
flatpak-1.12.9-7.el8_10.src.rpm1acb142ddc845a998f4630254d625e0a9f57ad274b3cba477e0f49c76d35d153-ol8_aarch64_codeready_builder
flatpak-1.12.9-7.el8_10.aarch64.rpm662c7b09f43c62ab87463205892f048959cd1f9eac839c809cd98a252c063962-ol8_aarch64_appstream
flatpak-devel-1.12.9-7.el8_10.aarch64.rpm4ae161998a76841edfc615b36abce01b3568c2543d88d0e6d250dc925585b21c-ol8_aarch64_codeready_builder
flatpak-libs-1.12.9-7.el8_10.aarch64.rpm24da3108d64be4aca24e6f20f743e8ccf6e77cd39126ccc972c84002f021b2fb-ol8_aarch64_appstream
flatpak-selinux-1.12.9-7.el8_10.noarch.rpmfb6edc0da3fbb3416733ba4da90561c02f6bfe7217b287770a7eefe4fa26292b-ol8_aarch64_appstream
flatpak-session-helper-1.12.9-7.el8_10.aarch64.rpm3cc4b9329aa98d5d4768c0bb85d4099f7ca2cd7c4eea2b43b08e55cbd6bd8561-ol8_aarch64_appstream
Oracle Linux 8 (x86_64) flatpak-1.12.9-7.el8_10.src.rpm1acb142ddc845a998f4630254d625e0a9f57ad274b3cba477e0f49c76d35d153-ol8_x86_64_appstream
flatpak-1.12.9-7.el8_10.src.rpm1acb142ddc845a998f4630254d625e0a9f57ad274b3cba477e0f49c76d35d153-ol8_x86_64_codeready_builder
flatpak-1.12.9-7.el8_10.i686.rpmac4feb55a527432ac7ea3661063ef79bcf70be145a9cbf8bff327dc35dc830ff-ol8_x86_64_codeready_builder
flatpak-1.12.9-7.el8_10.x86_64.rpmfd813be222f19eae0e5ba9649489eca9cee1657dda4bb598addab4df87c3ac08-ol8_x86_64_appstream
flatpak-devel-1.12.9-7.el8_10.i686.rpm16b879a38c6082f2ca128cb504b63451bb4c98b26aebbe08d6b1da804d826c67-ol8_x86_64_codeready_builder
flatpak-devel-1.12.9-7.el8_10.x86_64.rpme9ad71d4ee10eb703c1b3da47b6cedf70aa6afa03398d9a84d2c37f9d07cac60-ol8_x86_64_codeready_builder
flatpak-libs-1.12.9-7.el8_10.i686.rpm54488d199b4f20bfb1e3845296907dc263f017b5f4c898946ead03fd6933f06c-ol8_x86_64_appstream
flatpak-libs-1.12.9-7.el8_10.x86_64.rpm23da856e78df0c33bb72160f76df1cb008c22d1c94ba29a8132d5e30efcd07a2-ol8_x86_64_appstream
flatpak-selinux-1.12.9-7.el8_10.noarch.rpmfb6edc0da3fbb3416733ba4da90561c02f6bfe7217b287770a7eefe4fa26292b-ol8_x86_64_appstream
flatpak-session-helper-1.12.9-7.el8_10.i686.rpmffc47c740eb52f7990f3dc754c9f1beb4649820a20294eba77cb1cd7c3848264-ol8_x86_64_codeready_builder
flatpak-session-helper-1.12.9-7.el8_10.x86_64.rpm1316391b790c931286c8c863bc06d186e8a0350baa8633a66877f4df98fa0a40-ol8_x86_64_appstream



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete