-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: libflatpak-doc
Architecture: all
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 libflatpak-doc - Application deployment framework for desktop apps (documentation)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 eb163b667206175229d9d9b011225229edee305f 15605 flatpak_1.16.6-1~deb13u3_all-buildd.buildinfo
 24816048418308edaba3183e4a974c28f099723d 166452 libflatpak-doc_1.16.6-1~deb13u3_all.deb
Checksums-Sha256:
 fc801050e22a2a6b8d91ef9da638b30abd5ecfbe65cf2915a30f4917fcdb7087 15605 flatpak_1.16.6-1~deb13u3_all-buildd.buildinfo
 2bcd2c846d8aad03745aaf75c116d5a8213ff21cf68ba07559831666ac1601ed 166452 libflatpak-doc_1.16.6-1~deb13u3_all.deb
Files:
 7e745a307d09f04d46fdc9e3523cb22b 15605 admin optional flatpak_1.16.6-1~deb13u3_all-buildd.buildinfo
 0a6bd916da74ddffddb5e4ecae3be6e9 166452 doc optional libflatpak-doc_1.16.6-1~deb13u3_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmq6dS4ACgkQmgPNRvTf
/zfvfhAAuAE7aRbfvGL1y+X9jfqmnwL/CWnG4nqfBm/e6qEB2ATp3ZmCYOy61jvD
FFv3dYcxBwr88ol3gwIXNSYilIAuiIIUun6eeOPmYIG4L42LHNE4hICtegO7PdYv
vcZCbkBCYOPvYD0LEtCXE5AwVH0/tGboi5Gxhsm8xGltjsvphUBpCvWSdBGwgo5o
2JFuMo/irIU2Ix6Ou3RlsyFI6ov0CJ5zlnbzJxJ8vYA73wbIjEMI/XpmfgAc2wnb
wORN2glYx8dQsWwEblkbzvEKAz5rPIIKR7R6xGqlyeEsH/bIJRXgbQxPYUZoXU7w
KaHxWAGOwXly/Z085czWp3hvI8dUyTI0kJvjCHWsrLVSQ5H2Nhm777lRhZzGXXka
dD6wUKJvRsZdbs+Ytb3y1obJmDSDSOsYicuhgdX18qG9B+LjeLIh8qDlYZCg47JB
zX1TuHG9hSfekv/O48ftC/RnJ97XJAjJ/wdY2h7xa0wspi6P0GlmUcBZ2H1JILxd
rOORMAF7VYP/59bsg+h1sazVpKK4tIYdkq29cNnrvTebTUUDcAoIkW33g+eiLYSm
yA7QQYQdM7sMfXkPRBbdnPnkQYYGTSvZnR6eEwTTR0geqnKKT0FgAiVJ5KqBDERK
LKWHpuw/5fh+d3Q1tI+CWE14jxdSTCxG8CL6boU3r+TrsLiipSo=
=jv5s
-----END PGP SIGNATURE-----