Oracle Linux 8 : flatpak (ELSA-2026-80687)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-80687 advisory. - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271507 - Avoid symlink path traversal in revokefs writer...

Oracle Linux 9 : flatpak (ELSA-2026-80497)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-80497 advisory. - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271518 - Avoid symlink path traversal in revokefs writer...

CLSA-2026-1792153368 flatpak: Fix of CVE-2026-96280

CVE-2026-96280: the OCI delta parser read sizes as guint64 and passed them to gsize APIs, and deltareaddata allocated size + 1 bytes, which wraps to zero for size GMAXSIZE; sizes are now gsize and clamped to GMAXSIZE, deltareaddata rejects size GMAXSIZE and delta paths longer than PATHMAX are...

flatpak security update

1.12.9-7 - Use gsize for OCI delta sizes and harden delta parser CVE-2026-96280 Resolves: RHEL-271507 1.12.9-6 - Avoid symlink path traversal in revokefs writer CVE-2026-96808 Resolves: RHEL-267897 - Prevent arbitrary write as root via extra-data extraction CVE-2026-96275 Resolves: RHEL-267425...