Release date:
2026-10-01 08:56:03 UTC
Description:
- CVE-2026-96808: the revokefs writer validated the paths its unprivileged
client sends with validate_path()/get_valid_path(), which rejected literal
".." components but followed symlinks, so a local user holding two revokefs
sessions could make one session write through a symlink into the other and
tamper with ostree objects after flatpak-system-helper had verified them;
the request handlers now resolve the parent directory with
glnx_chaseat(GLNX_CHASE_RESOLVE_BENEATH) through the new chase_parent(),
chase_request_path(), chase_request_2path() and chase_request_any_and_path()
helpers and act on the final component with *at() syscalls confined beneath
basefd
Updated packages:
-
flatpak-1.12.9-4.el9_6.tuxcare.els4.aarch64.rpm
sha:5acbf8a87ec2ba995c812afe42543fbfc9c9fd74831ab0ffa19d83fdac3ebe56
-
flatpak-1.12.9-4.el9_6.tuxcare.els4.i686.rpm
sha:f5ad9656002e6530f0b2064ffd8aa7d346297b88e309609946ed548fa4804cf1
-
flatpak-1.12.9-4.el9_6.tuxcare.els4.x86_64.rpm
sha:cda8b99731245680deeaf452ea08ed8e7857e3da6e1076114311b4b0bbfe8212
-
flatpak-devel-1.12.9-4.el9_6.tuxcare.els4.aarch64.rpm
sha:ae120873639630706ef0cf3726124708edeefe6d3ef541390b09edccd1f0cc1f
-
flatpak-devel-1.12.9-4.el9_6.tuxcare.els4.i686.rpm
sha:93f540ae0592d8d9fdf4ae8d866c694e1ce0dde9a4a60e63bb5d7894f51f41a6
-
flatpak-devel-1.12.9-4.el9_6.tuxcare.els4.x86_64.rpm
sha:4c65d4109b11f1b77c08a2a1614b9d486ee61c1dd1166ee65bde18878b8ea84e
-
flatpak-libs-1.12.9-4.el9_6.tuxcare.els4.aarch64.rpm
sha:3777da74b9df5024b032013790a569bb8f1f9cb43328fa7b7b5bdbfcb9900d8e
-
flatpak-libs-1.12.9-4.el9_6.tuxcare.els4.i686.rpm
sha:c985e6f22f090849f42234d2e810e25dd70f5dfd2abbe1fe6a0a4a66dbf9e286
-
flatpak-libs-1.12.9-4.el9_6.tuxcare.els4.x86_64.rpm
sha:6bb42eafc25ef3b0f5934a9a55da45b518d8562d24c7ea8bcbccb53792a44c83
-
flatpak-selinux-1.12.9-4.el9_6.tuxcare.els4.noarch.rpm
sha:46cbae641378fed085f190150d45daaec06371c458de3d67e3013f81327b2ce2
-
flatpak-session-helper-1.12.9-4.el9_6.tuxcare.els4.aarch64.rpm
sha:02e2afc3e0addc2a64f4d036f7b75e613dcf2f0a77ae7d232ada0abcc954b7fc
-
flatpak-session-helper-1.12.9-4.el9_6.tuxcare.els4.i686.rpm
sha:091f34ef0ce5cbc75b91968e8461d79b3477bb2f6aa1add1308dbb10f42b661c
-
flatpak-session-helper-1.12.9-4.el9_6.tuxcare.els4.x86_64.rpm
sha:7e621cdc90b53ff5e6e2ee95c4ada57c1458ced38be5d18b1f7dfdbb58ccfdea
-
flatpak-tests-1.12.9-4.el9_6.tuxcare.els4.aarch64.rpm
sha:5f90dcbf7f1c9bf0ec381e682b982541687d032f6fecde4b5550c810de837c79
-
flatpak-tests-1.12.9-4.el9_6.tuxcare.els4.i686.rpm
sha:1f6a23892602f9a73f5e005cb26a308e4fb6090433b2cb21c0bfdc9f6758ac75
-
flatpak-tests-1.12.9-4.el9_6.tuxcare.els4.x86_64.rpm
sha:bf916d358b48f00cf2918a0b640e78438b598dde5effb793a94ce0ae460bb97f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
