OESA-2026-4225 flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the...

OESA-2026-4224 flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the...

[SECURITY] Fedora 44 Update: flatpak-builder-1.4.12-1.fc44

Flatpak-builder is a tool for building flatpaks from sources. See https://flatpak.org/ for more information...

Linux Distros Unpatched Vulnerability : CVE-2026-97026

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flatpak creates temporary child repository directories under the user cache with world-writable permissions 0777. On multi-user systems with a permissive umask...

CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1777541348)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1777541348 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate th...

CentOS Linux 7 [TuxCare] Security Update: flatpak / flatpak-builder / flatpak-devel / flatpak-libs (CENTOS7:CLSA-2026:1789577977)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1789577977 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2025:1740132708)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1740132708 advisory. - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8,...

Fedora 44 : flatpak-builder (2026-9b73fdb8e6)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-9b73fdb8e6 advisory. Update to 1.4.12 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1776949031)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1776949031 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files...

AlmaLinux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expo...

Rocky Linux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1781603962)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1781603962 advisory. - Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the...

SUSE CVE-2026-97023

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is...

SUSE CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

DEBIAN-CVE-2026-97029

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill0, signal or killpg0, signal calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processe...

CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

DEBIAN-CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-97029

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill0, signal or killpg0, signal calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processe...

UBUNTU-CVE-2026-97029

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill0, signal or killpg0, signal calls from reaching processes outside the sandbox that share the same process group. A malicious or compromised Flatpak app can use this to cause denial of service by terminating processe...

UBUNTU-CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-97029

A vulnerability in Flatpak allows a sandboxed application to bypass process ID namespace separation . Specifically, the kill(0, signal) or killpg(0, signal) calls can reach processes outside the sandbox if they share the same process group . A malicious or compromised Flatpak app can exploit this...