-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym
Architecture: i386
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: i386 Build Daemon (x86-grnet-01) <buildd_amd64-x86-grnet-01@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 flatpak    - Application deployment framework for desktop apps
 flatpak-tests - Application deployment framework for desktop apps (tests)
 gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection)
 libflatpak-dev - Application deployment framework for desktop apps (development)
 libflatpak0 - Application deployment framework for desktop apps (library)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 e1083eca57df15143ae8fdeec00ae0c50e0e30ff 6514060 flatpak-dbgsym_1.16.6-1~deb13u3_i386.deb
 86267b8b72579eba7a060dfc2f96feeff66a314a 9294964 flatpak-tests-dbgsym_1.16.6-1~deb13u3_i386.deb
 3692892a62eb033aa08acab4a56d0967c0c7c714 1480176 flatpak-tests_1.16.6-1~deb13u3_i386.deb
 4c6735468a32203f5d50ecbc0fe26e0f74164e35 17578 flatpak_1.16.6-1~deb13u3_i386-buildd.buildinfo
 3aecc83cf9ddafa3cb70cc22f992e50eb23b3933 1604532 flatpak_1.16.6-1~deb13u3_i386.deb
 9cbc982224457f6a8c49f5f3517e883fdc8a8be9 29720 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_i386.deb
 7cf8dfbe29e955c09b493d0855461236bdaba6b1 74024 libflatpak-dev_1.16.6-1~deb13u3_i386.deb
 4bafc65bbac8d3c993b55b2d7dafa04eb5f248ad 1502920 libflatpak0-dbgsym_1.16.6-1~deb13u3_i386.deb
 5b6ef4fccecce1da20362a521f8e909c583c1a45 428156 libflatpak0_1.16.6-1~deb13u3_i386.deb
Checksums-Sha256:
 0e1f70ee8dbd37c56e8c3bcaf34fec0991a98c0d52936a38ece7d289751c16ea 6514060 flatpak-dbgsym_1.16.6-1~deb13u3_i386.deb
 6a1773935aa4cc163df22fd80621cc2a52834d1d1b3388790a547ba185b004f1 9294964 flatpak-tests-dbgsym_1.16.6-1~deb13u3_i386.deb
 061a2c3886ba3356a284c02a8c8ba9a059042bf10bcbf2e913d2fc8cf7623530 1480176 flatpak-tests_1.16.6-1~deb13u3_i386.deb
 6a824602db287a21f52540a0d94e474f4f0b5aa7175dbcaab9a29ff90721bf4a 17578 flatpak_1.16.6-1~deb13u3_i386-buildd.buildinfo
 e02eae763374b04c15714e425abf08a429a4e905db6b674fd15ee35c8076fe26 1604532 flatpak_1.16.6-1~deb13u3_i386.deb
 6886a8768d1fa10d4eefc8886a74cd2617f7805e489bf94cac14aecaa019f468 29720 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_i386.deb
 b6574c91ed3ed0301f1c9af58ffc559ba76d8fe4c53c9d3e6a031b9997d098f4 74024 libflatpak-dev_1.16.6-1~deb13u3_i386.deb
 d8ed856778dea87a675675c140b49608e0c6e6d905a605f2eb1caf17ab0c1623 1502920 libflatpak0-dbgsym_1.16.6-1~deb13u3_i386.deb
 d69dde8acd817c04a9c04ccd33e2dc6e392fe5c77e5269f0c911c6e1d6065376 428156 libflatpak0_1.16.6-1~deb13u3_i386.deb
Files:
 4c3778dadf6711458ddcb758da25e81a 6514060 debug optional flatpak-dbgsym_1.16.6-1~deb13u3_i386.deb
 5fe265e2e2356f22ac896e5737c60a71 9294964 debug optional flatpak-tests-dbgsym_1.16.6-1~deb13u3_i386.deb
 623566a2bdd7f903871a25696cee85ed 1480176 misc optional flatpak-tests_1.16.6-1~deb13u3_i386.deb
 ba29281a13a7a3015bd55529e52d44a1 17578 admin optional flatpak_1.16.6-1~deb13u3_i386-buildd.buildinfo
 498af0fd5f94e28d22d39498decd8149 1604532 admin optional flatpak_1.16.6-1~deb13u3_i386.deb
 40593f24520dfc779c92358f7fdd4a05 29720 introspection optional gir1.2-flatpak-1.0_1.16.6-1~deb13u3_i386.deb
 74d161d682b8739af162a2f98fbdbbfd 74024 libdevel optional libflatpak-dev_1.16.6-1~deb13u3_i386.deb
 049b3d8d2b91a0ed4a1dbce28ffd228b 1502920 debug optional libflatpak0-dbgsym_1.16.6-1~deb13u3_i386.deb
 1b321d154f7547ddd25f19b3ef7ea613 428156 libs optional libflatpak0_1.16.6-1~deb13u3_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEPAUaMA0H0rOy6qBWf2INRiCdaWIFAmq6dX0ACgkQf2INRiCd
aWJQAw//eRd+CoMVh2RZPDOMYC9qnsThR+iati+CHmEz7xXskDPS3hbMuLP09Woy
KOylT63TCyR4aX30YA10xLM1lOynjomeqGZrTT7nIynjkFZA3kh2/CE1CRaBSkP9
DFxVT7KkWS0QV2UxhoNYlkdtxa6iYPfSHtJgfwfFukTP69+RxcBNq57EuqbYmYIi
YUZFd1Aj4mV60K7M7FESbU2a/uVx19Jjm1i/X4lTkHbIw3hmT74vPpTS7HpyE2SF
RuF3h0Te4DHLf/jX6cx6069sYjkRupQnzY/H3bSm8/MOgRALl2xVC7fnOsbNR+vU
k7jJNjIBnK9wZcwgJBScMI13xbbGhdup5vHMzS2PigwZYl7ov/4eKj7BsUMmVlS5
0h3pMGddkuMCdhqsqQQG3IbGfIUp6PPtogM327mXBrybSQTZkSB47+wpTN0d9f1U
japqiDNx9mKvXu6K0+GBkQWIcv0pI0VSvmsrLIzwXXqTXCzWRo1C7oK6xKvnLahP
awPUVQ4Xn336pGV+bvewShHJP7LvC36wG9o3wlcKbr1E1dSH6f4nO+mverOpYg0y
Gh6vaZb/neg9f/QqTxB+laJDCRVgRM9XXjskbpW59N/5OHz6veBSsqSiaBwt8b1U
3PWg7MB0dQyNysK/kLWjLtLibx94UrSWksCFCwak/hkJeZyEaM8=
=bFjJ
-----END PGP SIGNATURE-----