[CLSA-2026:1792153368] flatpak: Fix of CVE-2026-96280
Type:
security
Severity:
Important
Release date:
2026-10-16 12:22:57 UTC
Description:
- CVE-2026-96280: the OCI delta parser read sizes as guint64 and passed them to gsize APIs, and delta_read_data() allocated size + 1 bytes, which wraps to zero for size G_MAXSIZE; sizes are now gsize and clamped to G_MAXSIZE, delta_read_data() rejects size G_MAXSIZE and delta paths longer than PATH_MAX are rejected
CVEs fixed:
Updated packages:
  • flatpak-1.12.9-4.el9_6.tuxcare.els6.aarch64.rpm
    sha:7d6a00917a195c08a360348af88c38e80ab0d1922d4b50b5331d4cf4ec13a34f
  • flatpak-1.12.9-4.el9_6.tuxcare.els6.i686.rpm
    sha:e26faddbffa2722b43bd4a3b10023d90657a5115dc53469a3008532c0afb4ccc
  • flatpak-1.12.9-4.el9_6.tuxcare.els6.x86_64.rpm
    sha:98598c86286d85d3999dbf8f3c445038ec790a4a52fd493dc2a5939fcf8e136d
  • flatpak-devel-1.12.9-4.el9_6.tuxcare.els6.aarch64.rpm
    sha:7562399761a165de211319ac496a765644138e94c68df07ca6dfd322444e2fc8
  • flatpak-devel-1.12.9-4.el9_6.tuxcare.els6.i686.rpm
    sha:57ac1e7af0abe51274549d18cd1b5a9edc12eccae330951fb4556e61e24c5009
  • flatpak-devel-1.12.9-4.el9_6.tuxcare.els6.x86_64.rpm
    sha:c9de2ef808ee7e612026b898a3f2583b758dd95c6ab76b274a3acbf792b6f2f9
  • flatpak-libs-1.12.9-4.el9_6.tuxcare.els6.aarch64.rpm
    sha:b937ecf27bd616cebedd40a17db6be813d9dc9c1d2576fc9b361361d2d5ecc7a
  • flatpak-libs-1.12.9-4.el9_6.tuxcare.els6.i686.rpm
    sha:b355f3abf34c78c774e2d9cbb02f6d85c2e2caa82cd598fd62cd9bb0e53d457f
  • flatpak-libs-1.12.9-4.el9_6.tuxcare.els6.x86_64.rpm
    sha:a81b205259663edf674ba29318936cceb5a932147405bfc517d23f58ffeb8062
  • flatpak-selinux-1.12.9-4.el9_6.tuxcare.els6.noarch.rpm
    sha:213a9c49584ce481ad3cf514afbfa7e79617619d1151cb1f4b042dc8ed5aeea5
  • flatpak-session-helper-1.12.9-4.el9_6.tuxcare.els6.aarch64.rpm
    sha:6691184a85dc66d3b2b08e8284726e8d5122dfe746998f05cf265749c1d20ef8
  • flatpak-session-helper-1.12.9-4.el9_6.tuxcare.els6.i686.rpm
    sha:a3aad929dd3944d43563873e1b3a03b32dcd8848faf0add257cae03e22c1703c
  • flatpak-session-helper-1.12.9-4.el9_6.tuxcare.els6.x86_64.rpm
    sha:07d99cc95bcabd7ca81a075abe15dafa28b19ff65de50317e60c617a0c354ca0
  • flatpak-tests-1.12.9-4.el9_6.tuxcare.els6.aarch64.rpm
    sha:94e164f8bfb14fb83602ba54e72912681ae7645ca813802a3f6f76df0b5c0d52
  • flatpak-tests-1.12.9-4.el9_6.tuxcare.els6.i686.rpm
    sha:fd6b7932f81c498f690ae2d4d422d598f553f654ff26cfde67a80ed2f04977d6
  • flatpak-tests-1.12.9-4.el9_6.tuxcare.els6.x86_64.rpm
    sha:4dce5885e7a5ee86751c4e8c1bec05b544edd01be749456ab5e3774342902979
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.