Rocky Linux 9 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2026_80496)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680496 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding descriptio...

Rocky Linux 10.2 [CIQ] Security Update: flatpak-builder / flatpak-builder-debuginfo / etc (crlsa-2026_80495)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202680495 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_80497)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202680497 advisory. flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: flatpak (UTSA-2026-130041)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130041 advisory. In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code executi...

AlmaLinux 9 : flatpak-builder (ALSA-2026:80496)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:80496 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding descripti...

AlmaLinux 10 : flatpak-builder (ALSA-2026:80495)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:80495 advisory. flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git- am CVE-2026-86320 Tenable has extracted the preceding...

flatpak-builder security update

An update is available for flatpak-builder. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Flatpak-builder is a tool for building flatpaks from sources. Securi...

RLSA-2026:80495 Important: flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git-am CVE-2026-86320 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

RLSA-2026:80498 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

RLSA-2026:80497 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

RLSA-2026:80496 Important: flatpak-builder security update

Flatpak-builder is a tool for building flatpaks from sources. Security Fixes: flatpak-builder: Host code execution via git am hook execution in patch source extraction use-git-am CVE-2026-86320 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

flatpak-builder security update

An update is available for flatpak-builder. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Flatpak-builder is a tool for building flatpaks from sources. Securit...

RLSA-2026:80687 Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak: Arbitrary code execution via missing symlink protection CVE-2026-90616 flatpak: flatpak: Arbitrary write access as root via extra-data extraction CVE-2026-96275...

Oracle Linux 9 : flatpak-builder (ELSA-2026-80496)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-80496 advisory. 1.2.3-1.1 - Disable git hooks when applying patches CVE-2026-86320 Resolves: RHEL-262193 Tenable has extracted the preceding description block directly from th...

Oracle Linux 8 : flatpak-builder (ELSA-2026-80973)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-80973 advisory. 1.2.3-2 - Disable git hooks when applying patches CVE-2026-86320 Resolves: RHEL-262183 Tenable has extracted the preceding description block directly from the...

flatpak security update

1.12.9-4.0.1 - Restore the flatpak-builder 1.0.0 subpackage Orabug: 40105180 - Move flatpak-session-helper back into flatpak Orabug: 40105180 1.12.9-4 - Import to OL7 Orabug: 39695281 1.12.9-4 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165633 - Fi...

flatpak-builder: Host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

Important: Red Hat Security Advisory: flatpak-builder security update

An update for flatpak-builder is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

flatpak: flatpak: Buffer overflow in OCI delta stream path names on 32-bit systems

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize 32 bits on 32-bit systems, causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an O...

flatpak: Flatpak: Arbitrary code execution via missing symlink protection

A flaw was found in Flatpak. A malicious sandboxed application can exploit missing symlink protection during the creation and bind-mounting of app data directories. By manipulating attacker-controlled path components, a malicious symlink can redirect these directories to arbitrary locations on th...