Release date:
2026-09-22 00:12:54 UTC
Description:
- CVE-2026-90616: flatpak_ensure_data_dir and flatpak_run_setup_base_argv
resolved the app data subdirectories by path, so an app could replace them
with symlinks between runs and have them followed during the next sandbox
setup; both now resolve them with glnx_chase_and_mkdirat()/glnx_chaseat()
confined beneath the app data directory
- Update the bundled libglnx with the glnx_chaseat API the above fix needs
- Carry the upstream regression test for the above fix
Updated packages:
-
flatpak-1.12.9-4.el9_6.tuxcare.els3.i686.rpm
sha:4b255bf3f0e5db811012a414503dba88069e2724f363eb158587fbcd2e06297d
-
flatpak-1.12.9-4.el9_6.tuxcare.els3.x86_64.rpm
sha:a7bf4d4f290c80912e4d5c16c6c11ff155f0cc9220e63798b6f89e7fe11d6213
-
flatpak-devel-1.12.9-4.el9_6.tuxcare.els3.i686.rpm
sha:ceb7d81018a842ae4e24da04bac3a653f9d48a9c3bab03282c4f209071daa89a
-
flatpak-devel-1.12.9-4.el9_6.tuxcare.els3.x86_64.rpm
sha:e0f5e13e8d33b0043b54c445b96fd5ced4d47e9a760ca06a57775b61ab1401c2
-
flatpak-libs-1.12.9-4.el9_6.tuxcare.els3.i686.rpm
sha:dfea3df91d0b5bff0caf28f764988d355af1b3bcdd287325417aa72538a19705
-
flatpak-libs-1.12.9-4.el9_6.tuxcare.els3.x86_64.rpm
sha:f3ba3e1fab403fcb8213d4972feed1e6b41c5b1a14d3e88c2bc82838d6b02063
-
flatpak-selinux-1.12.9-4.el9_6.tuxcare.els3.noarch.rpm
sha:e0bbed2c87a0f2f19e3a7f09fdda52396d6328054952e2075fd9b9ab1108960e
-
flatpak-session-helper-1.12.9-4.el9_6.tuxcare.els3.i686.rpm
sha:b11a8d99c8b35578d06d12729024f88bf71c664b9abee55cd5191d68d20dbb88
-
flatpak-session-helper-1.12.9-4.el9_6.tuxcare.els3.x86_64.rpm
sha:2a31f8a6c19631a242a6b2ee237948015e036dde6acb192dfa51a31ecb354927
-
flatpak-tests-1.12.9-4.el9_6.tuxcare.els3.x86_64.rpm
sha:be118772c9c59fb6dcfce90bd13418b1ed10dda88f01c9015364a1822c88f06c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
