{"id":"SUSE-SU-2026:4944-1","summary":"Security update for flatpak","details":"This update for flatpak fixes the following issues:\n\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including openh264.\n + Fix unusable sandbox-expose paths affecting Epiphany.\n + Fix installed tests and handling of file descriptor arguments.\n- Changes from version 1.16.5:\n + Fix regressions from the sandbox escape security fix affecting\n browsers, browser-based apps and Steam.\n + Expand test coverage of flatpak-run features used by the portal.\n- Changes from version 1.16.4:\n + Prevent arbitrary file reads in the system-helper context\n (GHSA-2fxp-43j9-pwvc).\n + Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg).\n- Changes from version 1.16.3:\n + Be selective about mapping font-dirs.xml in flatpak build.\n- Changes from version 1.16.2:\n + Support reinstalling bundle installations and Intel Xe VA-API.\n + Add cancellation support for curl downloads.\n + Fix font configuration, mask and pin configuration reloads,\n unintended home directory access, flatpak kill, OCI support,\n memory leaks and crashes.\n- Changes from version 1.16.1:\n + Allow updating existing apps under parental controls by default.\n + Use instance IDs for systemd scopes and include /dev/udmabuf\n with --device=dri.\n + Speed up prune --dry-run and permission-reset.\n + Support TLS certificates in /etc/containers/certs.d for OCI.\n + Fix portal crashes, sandbox environment handling, accessibility\n bus discovery, error reporting and shell completion.\n + Update documentation and translations.\n","modified":"2026-10-31T18:00:03.939717669Z","published":"2026-10-29T16:29:47Z","related":["CVE-2026-90616","CVE-2026-92162","CVE-2026-96275","CVE-2026-96276","CVE-2026-96280","CVE-2026-96281","CVE-2026-96282","CVE-2026-96807","CVE-2026-96808"],"upstream":["CVE-2026-90616","CVE-2026-92162","CVE-2026-96275","CVE-2026-96276","CVE-2026-96280","CVE-2026-96281","CVE-2026-96282","CVE-2026-96807","CVE-2026-96808"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264944-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280236"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282514"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282515"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282516"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282518"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282519"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282520"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282523"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282524"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-90616"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92162"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96275"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96276"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96280"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96281"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96282"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96807"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96808"}],"affected":[{"package":{"name":"flatpak","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","purl":"pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"ecosystem_specific":{"binaries":[{"system-user-flatpak":"1.16.6-150600.3.12.1","typelib-1_0-Flatpak-1_0":"1.16.6-150600.3.12.1","flatpak":"1.16.6-150600.3.12.1","flatpak-devel":"1.16.6-150600.3.12.1","flatpak-remote-flathub":"1.16.6-150600.3.12.1","flatpak-zsh-completion":"1.16.6-150600.3.12.1","libflatpak0":"1.16.6-150600.3.12.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4944-1.json"}},{"package":{"name":"flatpak","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"ecosystem_specific":{"binaries":[{"flatpak-zsh-completion":"1.16.6-150600.3.12.1","libflatpak0":"1.16.6-150600.3.12.1","system-user-flatpak":"1.16.6-150600.3.12.1","typelib-1_0-Flatpak-1_0":"1.16.6-150600.3.12.1","flatpak":"1.16.6-150600.3.12.1","flatpak-devel":"1.16.6-150600.3.12.1","flatpak-remote-flathub":"1.16.6-150600.3.12.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4944-1.json"}},{"package":{"name":"flatpak","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150600.3.12.1"}]}],"ecosystem_specific":{"binaries":[{"flatpak-zsh-completion":"1.16.6-150600.3.12.1","libflatpak0":"1.16.6-150600.3.12.1","system-user-flatpak":"1.16.6-150600.3.12.1","typelib-1_0-Flatpak-1_0":"1.16.6-150600.3.12.1","flatpak":"1.16.6-150600.3.12.1","flatpak-devel":"1.16.6-150600.3.12.1","flatpak-remote-flathub":"1.16.6-150600.3.12.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4944-1.json"}}],"schema_version":"1.9.2"}