[CLSA-2026:1792427434] flatpak: Fix of 5 CVEs
Type:
security
Severity:
Critical
Release date:
2026-10-23 15:49:02 UTC
Description:
- CVE-2026-34078: fix the portal sandbox-expose symlink refusal, which never triggered because O_PATH|O_NOFOLLOW opens the symlink instead of failing - Raise the release to 13.0.1 and build every shared EL7 target with dist .el7_9, so the package outranks the vendor releases on oraclelinux7els (13.0.1.el7_9, ELSCVE-228058) and rhel7els (13.el7_9, ELSCVE-228171)
Updated packages:
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:8ff4a42f1f071cabd129c526ad51be859333457158a6578fbe9770b8c9c57e8b
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:e648d3af473e7691f5dcf400875f8887d53e6b626281132b1b03d1a6a0d09062
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:84faf81caa9fa849541fc57c89391b92da5b8c5bba213247c63a8e4a5ef9d9e6
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:25250fda18ed327ac364de4cd1e2a152058da8a684db39b5822a579186b48916
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:7ff4403ab7c3bb1261d1474eec8f49838842dd8ce507cb124dae54931bf29ab7
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:75a6dd57b28fd53b4cd34ee3d0621e6d285daf073d9c443c70b7c8b94f4632ac
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els1.i686.rpm
    sha:c26b07a6c474dc046354841cc5823e94cb3e170b3f588d172facb999c5a09035
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els1.x86_64.rpm
    sha:31da030d07a682e987405d31ffc3b3ff4756de14ad738516a54495a7b9d5c01f
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.