ELSA-2026-21757

ELSA-2026-21757 - flatpak security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-16

Description

[1.16.0-9.1]
- Fix arbitrary code execution via crafted symlinks in sandbox-expose options
Resolves: RHEL-165630
- Fix arbitrary file deletion on host via improper cache file path validation
Resolves: RHEL-170157

Related CVEs

CVE-2026-34078

CVE-2026-34079

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	flatpak-1.16.0-9.el10_2.1.src.rpm	a287b698d1228f932c1d46513080f518a88ab546c66eb8a318ea03c4bc297489	-	ol10_aarch64_appstream
	flatpak-1.16.0-9.el10_2.1.src.rpm	a287b698d1228f932c1d46513080f518a88ab546c66eb8a318ea03c4bc297489	-	ol10_aarch64_codeready_builder
	flatpak-1.16.0-9.el10_2.1.aarch64.rpm	5093a4a00768e79931c35ea2cf7922fcdc41cf9061b2d941167fc5fa5b9c8a5d	-	ol10_aarch64_appstream
	flatpak-devel-1.16.0-9.el10_2.1.aarch64.rpm	8f24887f84da2fcc53bb323eed5f39629ef88927c679b47a9436ebe0b5483d2e	-	ol10_aarch64_codeready_builder
	flatpak-libs-1.16.0-9.el10_2.1.aarch64.rpm	4dc97692db2c80c2b8eec81b5756ac6b50349818616ae74876bc9ea61610e214	-	ol10_aarch64_appstream
	flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm	ab467de1642c989fcd08d0a764f63700738581971408bd1155d9bba7fd57aa60	-	ol10_aarch64_appstream
	flatpak-session-helper-1.16.0-9.el10_2.1.aarch64.rpm	5a4c750597fc43eb340298ef30e2ef84d5dfa5f14dcfa1876f9980624baba396	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	flatpak-1.16.0-9.el10_2.1.src.rpm	a287b698d1228f932c1d46513080f518a88ab546c66eb8a318ea03c4bc297489	-	ol10_x86_64_appstream
	flatpak-1.16.0-9.el10_2.1.src.rpm	a287b698d1228f932c1d46513080f518a88ab546c66eb8a318ea03c4bc297489	-	ol10_x86_64_codeready_builder
	flatpak-1.16.0-9.el10_2.1.x86_64.rpm	fd8d2c159cfcd0c433a4d44643eb7e40d2b13e19e379692d2c46f1a4d7536bcc	-	ol10_x86_64_appstream
	flatpak-devel-1.16.0-9.el10_2.1.x86_64.rpm	cc7e0f92550a3ac5d4f57be4b4a11adf14807c20f7a6288142d8c13227cf28a3	-	ol10_x86_64_codeready_builder
	flatpak-libs-1.16.0-9.el10_2.1.x86_64.rpm	52f3d2718f33d894fde88fddec1ef54a13f5f66413e3fdb172daffaec13f9d94	-	ol10_x86_64_appstream
	flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm	ab467de1642c989fcd08d0a764f63700738581971408bd1155d9bba7fd57aa60	-	ol10_x86_64_appstream
	flatpak-session-helper-1.16.0-9.el10_2.1.x86_64.rpm	2c8226fd76adb8bf52c0cdc825245e3a47b13d1c0aa604257ec4da09f3125654	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team