ELSA-2026-35843 - flatpak security update
| Type: | SECURITY |
| Impact: | IMPORTANT |
| Release Date: | 2026-10-13 |
Description
[1.12.9-4.0.1]
- Restore the flatpak-builder 1.0.0 subpackage [Orabug: 40105180]
- Move flatpak-session-helper back into flatpak [Orabug: 40105180]
[1.12.9-4]
- Import to OL7 [Orabug: 39695281]
[1.12.9-4]
- Fix arbitrary code execution via crafted symlinks in sandbox-expose options
Resolves: RHEL-165633
- Fix arbitrary file deletion on host via improper cache file path validation
Resolves: RHEL-170160
[1.12.9-3]
- Fix previous changelog entry
[1.12.9-2]
- Backport upstream patches for CVE-2024-42472
- Require bubblewrap version that has new --bind-fd option backported for
addressing CVE-2024-42472
[1.12.9-1]
- Update to 1.12.9 (CVE-2024-32462)
[1.12.8-1]
- Rebase to 1.12.8 (RHEL-4220)
[1.10.8-3]
- Let flatpak own %{_sysconfdir}/flatpak (RHEL-15822)
[1.10.8-2]
- Make sure to use the RHEL-lifetime supported Python and no other (RHEL-2225)
[1.10.8-1]
- Rebase to 1.10.8 (#2222103)
- Fix CVE-2023-28100 and CVE-2023-28101 (#2180311)
Related CVEs
Updated Packages
| Release/Architecture | Filename | sha256 | Superseded By Advisory | Channel Label |
|
| Oracle Linux 7 (x86_64) | flatpak-1.12.9-4.0.1.el7.src.rpm | accafb3b7c25ce16d0af0eb281a08079a0e10875d58622b9ea8bd8cae24eefae | - | ol7_x86_64_latest_ELS |
| flatpak-1.12.9-4.0.1.el7.x86_64.rpm | f31af2d02660ebaba628846726c3bb2f8733002c902ad91d647fdcbcf1ae8ee0 | - | ol7_x86_64_latest_ELS |
| flatpak-builder-1.0.0-17.0.1.el7.x86_64.rpm | 1f9d41c7f3465c83d1a7e6c490997bcbd37b5e600ae485c43af5ee61e612681e | - | ol7_x86_64_latest_ELS |
| flatpak-devel-1.12.9-4.0.1.el7.x86_64.rpm | cae9a7c25ead70723570625f677bf33cf6e25de574a25c638280fab23bd1d551 | - | ol7_x86_64_latest_ELS |
| flatpak-libs-1.12.9-4.0.1.el7.x86_64.rpm | 39df5d312df3d871ae24a4aa229a5c85f87159ef20d553638bb5f26ab9c0989d | - | ol7_x86_64_latest_ELS |
This page is generated automatically and has not been checked for errors or omissions. For clarification
or corrections please contact the Oracle Linux ULN team
