[CLSA-2026:1792892768] flatpak: Fix of CVE-2026-34078
Type:
security
Severity:
Critical
Release date:
2026-10-25 21:40:59 UTC
Description:
- CVE-2026-34078: fix the portal sandbox-expose symlink refusal, which never triggered because O_PATH|O_NOFOLLOW opens the symlink instead of failing - Raise the release to 13.0.1 and build every shared EL7 target with dist .el7_9, so the package outranks the vendor releases on oraclelinux7els (13.0.1.el7_9, ELSCVE-228058) and rhel7els (13.el7_9, ELSCVE-228171)
CVEs fixed:
Updated packages:
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:1340f8c27c6d23193d58234b0ac289f60ba6d9cd6232e63b0b5f2b60760d7e09
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:a186943caf3a93fdeb0874f5119d2605e052c321e9ce5c62f566bc02a8703fab
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:bf06498376475b56cb6d42aa95d49a61664cc3cdd5ef50c7658bc932e655a2de
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:dd0cec6da2f0ee865240a17d3d08eb0aa7002e828a87d1b622b00f1ee9912f6e
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:801e3b70c5b75554f9c0930845abd1d975f208d5731ba8e8e16a28e503d39bdd
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:1a4281e757601999660d324be9aa299fa87c075ed547dd5369b6fbafdefecaed
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:d28742ba40e8a4e2f73097f65b6ba451d3d25fb16bc2554aac70c636c1cb817f
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:deeac13549674b45de282363a8d0c89a3cbf6bfe96d3c170035b30fe9b094758
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.