Format: 1.8
Date: Wed, 15 Apr 2026 20:27:40 +0100
Source: flatpak
Architecture: source
Version: 1.14.10-1~deb12u2
Distribution: bookworm-security
Urgency: high
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Closes: 1132943 1132944 1132945 1132946 1132960 1132968
Changes:
 flatpak (1.14.10-1~deb12u2) bookworm-security; urgency=high
 .
   * Security update
   * d/p/CVE-2026-34078-prep/*.patch:
     Backport libglnx changes required to address CVE-2026-34078
   * d/p/CVE-2026-34078/*.patch:
     Fix a sandbox escape involving symlinks passed to flatpak-portal.
     A malicious or compromised Flatpak app could exploit this to achieve
     arbitrary code execution on the host.
     (CVE-2026-34078, GHSA-cc2q-qc34-jprg) (Closes: #1132943)
   * d/p/CVE-2026-34079/*.patch:
     Prevent arbitrary file deletion outside the sandbox by a malicious or
     compromised Flatpak app
     (CVE-2026-34079, GHSA-p29x-r292-46pp) (Closes: #1132944)
   * d/p/GHSA-2fxp-43j9-pwvc/*.patch:
     Prevent a local user from reading any file that is readable by the
     _flatpak system user. A mitigation is that it would be very unusual
     for these files not to be readable by the original local user as well.
     (No CVE ID, GHSA-2fxp-43j9-pwvc) (Closes: #1132946)
   * d/p/GHSA-89xm-3m96-w3jg/*.patch:
     Prevent a local user from making another local user unable to cancel
     an ongoing download of apps or runtimes installed system-wide
     via the system helper.
     (No CVE ID, GHSA-89xm-3m96-w3jg) (Closes: #1132945)
   * d/p/portal-Use-G_LOCK_DEFINE_STATIC.patch,
     d/p/portal-Don-t-run-method-invocations-in-a-thread.patch:
     Add patches from upstream flatpak-1.14.x branch (which never got into a
     release before the branch was discontinued), originally from 1.16.1,
     fixing a thread-safety issue in flatpak-portal
   * d/p/1.16.5/*.patch:
     Add regression fixes taken from the upstream 1.16.5 release,
     fixing various regressions introduced by fixing CVE-2026-34078
     and improving test coverage
     (Closes: #1132960)
   * d/p/1.16.6/*.patch:
     Add regression fixes taken from the upstream 1.16.6 release,
     fixing additional regressions introduced by fixing CVE-2026-34078
     and improving test coverage
     (Closes: #1132968)
     - d/control: Add curl(1) to Build-Depends and flatpak-tests Depends
   * d/p/1.16.7/bwrap-Clarify-a-comment.patch,
     d/p/dir-Silence-a-spurious-warning-when-installing-extra-data.patch:
     Silence a spurious warning seen while testing 1.16.6
Checksums-Sha1:
 1eab0a2a6b793ac9564c86de468488e363ec0947 3018 flatpak_1.14.10-1~deb12u2.dsc
 29eda29e492f82aeeb3b670a89d7636267e35cf0 1647100 flatpak_1.14.10.orig.tar.xz
 52fcc6407ed227ae632db6625398800d175de844 833 flatpak_1.14.10.orig.tar.xz.asc
 5c9d2be5bf7d48a9405611e58d8e14a2dfb4f5ee 78968 flatpak_1.14.10-1~deb12u2.debian.tar.xz
 6ff0422962e556d0c1a3c2e8347463442e483c5a 11938 flatpak_1.14.10-1~deb12u2_source.buildinfo
Checksums-Sha256:
 fa73cd9f863d9e72a2f937d1bbd43f9b655e5d96e7cbb4577adfd7945bc77724 3018 flatpak_1.14.10-1~deb12u2.dsc
 6bbdc7908127350ad85a4a47d70292ca2f4c46e977b32b1fd231c2a719d821cd 1647100 flatpak_1.14.10.orig.tar.xz
 86f596ae816c77b6ee2789df177cc194d0a86d5ebd127d2a5c5cf99a627641ca 833 flatpak_1.14.10.orig.tar.xz.asc
 ed0c2bed6fcec0642f3824cc14ccc5c22d30d58e029f6c570e2a7ad82c3b4b9c 78968 flatpak_1.14.10-1~deb12u2.debian.tar.xz
 226ce1f59ca44499161450c2400dd04f4431a3e8bf19c472caa35a51519a18b0 11938 flatpak_1.14.10-1~deb12u2_source.buildinfo
Files:
 67bc9e6ff3d3ac84ae305220e78ff778 3018 admin optional flatpak_1.14.10-1~deb12u2.dsc
 4eb3f96ab7a73b01b408e5bb15630106 1647100 admin optional flatpak_1.14.10.orig.tar.xz
 067ee69526edc3294dcfb3d43fd99de6 833 admin optional flatpak_1.14.10.orig.tar.xz.asc
 58a6c35f6b83bc98fa6be23be65414d3 78968 admin optional flatpak_1.14.10-1~deb12u2.debian.tar.xz
 6fc12735b00c83d77de472e7282be712 11938 admin optional flatpak_1.14.10-1~deb12u2_source.buildinfo