-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym
Architecture: armhf
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: armhf Build Daemon (arm-ubc-04) <buildd_arm64-arm-ubc-04@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 flatpak    - Application deployment framework for desktop apps
 flatpak-tests - Application deployment framework for desktop apps (tests)
 gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection)
 libflatpak-dev - Application deployment framework for desktop apps (development)
 libflatpak0 - Application deployment framework for desktop apps (library)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 9b0d25ddd72373bab0a69a9fb128c6f1a0b4e175 7229772 flatpak-dbgsym_1.16.6-1~deb13u3_armhf.deb
 35fb9d692c457575dce561c47a0fd679ac2a6ae9 10302216 flatpak-tests-dbgsym_1.16.6-1~deb13u3_armhf.deb
 db0541c41261d77a97752090711fe2722fb814c9 1181200 flatpak-tests_1.16.6-1~deb13u3_armhf.deb
 c9908eb9c4a9ea80e9ddc56cff3aee5876461537 17564 flatpak_1.16.6-1~deb13u3_armhf-buildd.buildinfo
 6db81645b96c5c13aabe84edecff7d4f91bb1c4d 1390376 flatpak_1.16.6-1~deb13u3_armhf.deb
 759435e7994438b58c8cc075153ff54366d7f582 29716 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_armhf.deb
 cae4bb177f0b48063993f8238121c1fc689ac48e 74040 libflatpak-dev_1.16.6-1~deb13u3_armhf.deb
 acb0ee2fc9d27dc2f866757347517b2b67d4f537 1719248 libflatpak0-dbgsym_1.16.6-1~deb13u3_armhf.deb
 77a9a9d50a25ac8621e4179d0a0449e218db4dc2 341188 libflatpak0_1.16.6-1~deb13u3_armhf.deb
Checksums-Sha256:
 72051781ac54a6e224fc617b57cf55822758647a74d35b928b8316f34e822ed9 7229772 flatpak-dbgsym_1.16.6-1~deb13u3_armhf.deb
 7d718af7b8b5fcac7897935ca7d8cb10891efedf3899bf30c85b14132dfba07f 10302216 flatpak-tests-dbgsym_1.16.6-1~deb13u3_armhf.deb
 e3c72f18758ddd3a3c4e2a13d67dd17e40fdcc9697992c046b5d7095f3016715 1181200 flatpak-tests_1.16.6-1~deb13u3_armhf.deb
 0359c41ccda375fffa089649fb4ddfc1c62f1e175ca0a3f6f50f553e57255695 17564 flatpak_1.16.6-1~deb13u3_armhf-buildd.buildinfo
 f353133c57afc67f94cfea25f426df125bd51fa5d84703d989963b909bfa22e0 1390376 flatpak_1.16.6-1~deb13u3_armhf.deb
 f6c22a21ea3adec9a46078fd43ceacfe22380ff1e147ab3723a9b353f4ea377f 29716 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_armhf.deb
 b14b74492858f63f9c7d121c00ff886f2c7af894dbcb96ab25269bc37348c615 74040 libflatpak-dev_1.16.6-1~deb13u3_armhf.deb
 7bf1afe99487f51e00c491e65994955812be42b248eaea63b5af1bbb1b2438ff 1719248 libflatpak0-dbgsym_1.16.6-1~deb13u3_armhf.deb
 6ec64d9c25a2c0a8377139894ab5dbc6e288520645841044ca280c902fd86770 341188 libflatpak0_1.16.6-1~deb13u3_armhf.deb
Files:
 b6f5be18b23b0172f45c0584155031be 7229772 debug optional flatpak-dbgsym_1.16.6-1~deb13u3_armhf.deb
 90428db6cd7ac76e8f6fd7d6817f4821 10302216 debug optional flatpak-tests-dbgsym_1.16.6-1~deb13u3_armhf.deb
 125cab2a5d69c16e2d2a1191cd55f7ac 1181200 misc optional flatpak-tests_1.16.6-1~deb13u3_armhf.deb
 4918926700449f8fb3f86c772502d633 17564 admin optional flatpak_1.16.6-1~deb13u3_armhf-buildd.buildinfo
 ac25d32acd98634a208060ba936b2479 1390376 admin optional flatpak_1.16.6-1~deb13u3_armhf.deb
 54e44f1219bc92c685420a487ef2730c 29716 introspection optional gir1.2-flatpak-1.0_1.16.6-1~deb13u3_armhf.deb
 963f05e2440d633c4c5eb0001bc4e1dc 74040 libdevel optional libflatpak-dev_1.16.6-1~deb13u3_armhf.deb
 9145362d84f6883f8e252227f0bc6134 1719248 debug optional libflatpak0-dbgsym_1.16.6-1~deb13u3_armhf.deb
 bd6babd0e2ac3f44bfad6cd09a10c098 341188 libs optional libflatpak0_1.16.6-1~deb13u3_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEECx5fXZYVNP9tMtwlK1PZBedPspoFAmq6dWsACgkQK1PZBedP
sppEoA//aEH7oa+0Eyg4wndNmtA4D+yRAkVUk8fTnnxQ4HljKqXbcprHB17gnkTd
VjZN+e770g0fYD9CfBOXQU/xFyF53jdcuTk/BMhqQ7dUkS2Qarbenp11cnD7ZZBZ
IrK6a+W4UPwS4e+wUJ8nD4Jvr594RchdKY7diqfc5RqRHXEIGTQQDiN1KFYQzgej
oiaCgVxvGpKbKzSdusq7es/ta4t2o037f6MF8QjsAylcwKEpDsp+ZU+JYbr8a5Oi
XJPZM1aBfqi4PnE1vOy/tiChrNHjkmQOgbEdDIKZqjEG6EbZ+c4PMYXQgX0gJEXQ
mPWAWAUz5mPhusOZEMxyU4CuvtTx3JcuhRYJ0c1+NvgiZr1rbUbYMNj0ir1aXLyA
bNNHQCbQ+e4IUjVtoPLnERoHb/jAAOsIeAcBPOMB3GAJJYL55NemSJ7fPr2MAFzU
nLwu++XweeKbnelXGRxV7aso6A6m16OIcl0nDjnU3w8spUUih2CKL5ZEhElDoQ9Z
dl2xb3FWBKLThTwIZUjC2hUxW8Exqv9xlwuqhVpyEaYDJJw2tFHVrM69cejId50l
sh8+dwRhFIn2isdG562uEYT74G6yeNrh7Po28VM5zAzNhQaaC416wdWrqAjNMaNz
ePQp609B18KTW6SKe1D9Db2NlezxpDCPCyO9X7oJQw6RkrPssPk=
=WTc6
-----END PGP SIGNATURE-----