[CLSA-2026:1792427048] flatpak: Fix of 5 CVEs
Type:
security
Severity:
Critical
Release date:
2026-10-23 15:45:48 UTC
Description:
- CVE-2026-34078: fix the portal sandbox-expose symlink refusal, which never triggered because O_PATH|O_NOFOLLOW opens the symlink instead of failing - Raise the release to 13.0.1 and build every shared EL7 target with dist .el7_9, so the package outranks the vendor releases on oraclelinux7els (13.0.1.el7_9, ELSCVE-228058) and rhel7els (13.el7_9, ELSCVE-228171)
Updated packages:
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:7a87d6877d3863d840819078a87206cb2955aa3cefc5c2d743441c94ffba56e9
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:58d4761d0835ad51fb8b73b893e7be156e51e8489d7b42642fcae1f0907e9427
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:f503f72eb9e2b66ba1e23196a6f0656e94991aed1aeea96b71a6e6c3af66bb7e
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:3cd631c83d8b7ac7c511bce8150f446c19b8b5d961156684009e357358cabed4
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:b539d2453e620b7e92b520de6f6e91bed3af2652c96e0059e6b0007580b584fa
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:d17871fc61625fc8b2a2ed05d775a09bc8ccd64879638ac7869a4a5435a812f5
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:1da7effa90811575adffb305132daa0f99702a6cb08aa8db3008b757ca2843d9
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:b247baa885b3b32f4e74412fe501b0e8c83d90213217a3871dfce189b24bcf19
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.