{"id":"SUSE-SU-2026:5127-1","summary":"Security update for flatpak","details":"This update for flatpak fixes the following issues:\n\n- CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769).\n- CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770).\n- CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access\n  to files on the host (bsc#1280236).\n- CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514).\n- CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515).\n- CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516).\n- CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518).\n- CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519).\n- CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520).\n- CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523).\n- CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering\n  (bsc#1282524).\n\nChanges for flatpak:\n\n- Update to version 1.16.6 (jsc#PED-17048):\n + Fix file descriptor leaks affecting Chromium-based browsers.\n + Fix installing extra-data without a runtime, including OpenH264.\n + Ignore unusable sandbox-expose paths for portal sub-sandboxes,\n fixing Epiphany regressions.\n + Fix installed tests and handling of standard file descriptors\n passed as invalid flatpak run arguments.\n- Switch from Autotools to Meson, preserving system bubblewrap,\n xdg-dbus-proxy, curl and distribution-specific installation paths.\n- Require bubblewrap \u003e= 0.10.0 and GPGME \u003e= 1.8.0; add Meson,\n gettext, gtk-doc and polkit-agent build dependencies and drop\n obsolete intltool and libelf build dependencies.\n- Generate the system-user pre-script from the Meson build directory\n and package the tmpfiles configuration and renamed manual pages.\n","modified":"2026-11-07T11:30:04.138531740Z","published":"2026-11-06T08:27:38Z","related":["CVE-2026-34078","CVE-2026-34079","CVE-2026-90616","CVE-2026-92162","CVE-2026-96275","CVE-2026-96276","CVE-2026-96280","CVE-2026-96281","CVE-2026-96282","CVE-2026-96807","CVE-2026-96808"],"upstream":["CVE-2026-34078","CVE-2026-34079","CVE-2026-90616","CVE-2026-92162","CVE-2026-96275","CVE-2026-96276","CVE-2026-96280","CVE-2026-96281","CVE-2026-96282","CVE-2026-96807","CVE-2026-96808"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20265127-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1261769"},{"type":"REPORT","url":"https://bugzilla.suse.com/1261770"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280236"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282514"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282515"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282516"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282518"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282519"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282520"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282523"},{"type":"REPORT","url":"https://bugzilla.suse.com/1282524"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-34078"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-34079"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-90616"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-92162"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96275"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96276"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96280"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96281"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96282"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96807"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-96808"}],"affected":[{"package":{"name":"flatpak","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","purl":"pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"ecosystem_specific":{"binaries":[{"libflatpak0":"1.16.6-150500.3.21.1","system-user-flatpak":"1.16.6-150500.3.21.1","typelib-1_0-Flatpak-1_0":"1.16.6-150500.3.21.1","flatpak":"1.16.6-150500.3.21.1","flatpak-devel":"1.16.6-150500.3.21.1","flatpak-remote-flathub":"1.16.6-150500.3.21.1","flatpak-zsh-completion":"1.16.6-150500.3.21.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json"}},{"package":{"name":"flatpak","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","purl":"pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"ecosystem_specific":{"binaries":[{"libflatpak0":"1.16.6-150500.3.21.1","system-user-flatpak":"1.16.6-150500.3.21.1","typelib-1_0-Flatpak-1_0":"1.16.6-150500.3.21.1","flatpak":"1.16.6-150500.3.21.1","flatpak-devel":"1.16.6-150500.3.21.1","flatpak-remote-flathub":"1.16.6-150500.3.21.1","flatpak-zsh-completion":"1.16.6-150500.3.21.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json"}},{"package":{"name":"flatpak","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","purl":"pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"ecosystem_specific":{"binaries":[{"flatpak-zsh-completion":"1.16.6-150500.3.21.1","libflatpak0":"1.16.6-150500.3.21.1","system-user-flatpak":"1.16.6-150500.3.21.1","typelib-1_0-Flatpak-1_0":"1.16.6-150500.3.21.1","flatpak":"1.16.6-150500.3.21.1","flatpak-devel":"1.16.6-150500.3.21.1","flatpak-remote-flathub":"1.16.6-150500.3.21.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json"}},{"package":{"name":"flatpak","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","purl":"pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.6-150500.3.21.1"}]}],"ecosystem_specific":{"binaries":[{"flatpak-zsh-completion":"1.16.6-150500.3.21.1","libflatpak0":"1.16.6-150500.3.21.1","system-user-flatpak":"1.16.6-150500.3.21.1","typelib-1_0-Flatpak-1_0":"1.16.6-150500.3.21.1","flatpak":"1.16.6-150500.3.21.1","flatpak-devel":"1.16.6-150500.3.21.1","flatpak-remote-flathub":"1.16.6-150500.3.21.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5127-1.json"}}],"schema_version":"1.9.2"}