-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym
Architecture: amd64
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 flatpak    - Application deployment framework for desktop apps
 flatpak-tests - Application deployment framework for desktop apps (tests)
 gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection)
 libflatpak-dev - Application deployment framework for desktop apps (development)
 libflatpak0 - Application deployment framework for desktop apps (library)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 39029ef14e6a3a0716f6838bc4b4a21c1961e01d 7718952 flatpak-dbgsym_1.16.6-1~deb13u3_amd64.deb
 5b078c45f7cd3d1e07d484098ce58a3b6dba12ac 11025452 flatpak-tests-dbgsym_1.16.6-1~deb13u3_amd64.deb
 6498a99aa0b77906a821033bfad41e32a5bea537 1452788 flatpak-tests_1.16.6-1~deb13u3_amd64.deb
 90a2b272353392e4b778ab8b619d29ebeecefe1f 17698 flatpak_1.16.6-1~deb13u3_amd64-buildd.buildinfo
 d40a9094aa97bea9fd6708a26d8142668b752046 1557028 flatpak_1.16.6-1~deb13u3_amd64.deb
 1cfc9ce18a76b35e7e897a04a065c38ce52e0943 29716 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_amd64.deb
 29251a52d1dfd5945f5bf099138c390710e82bd2 74016 libflatpak-dev_1.16.6-1~deb13u3_amd64.deb
 8137ff593aa6602bab8b51806954b8e19f0e2dee 1767452 libflatpak0-dbgsym_1.16.6-1~deb13u3_amd64.deb
 07689aedd29273c165db9a7d35c3c8477554ad46 396956 libflatpak0_1.16.6-1~deb13u3_amd64.deb
Checksums-Sha256:
 312c16186af0dff0a6f152b62835940c8aa22ec8fe4a76428102b5a0cee12c82 7718952 flatpak-dbgsym_1.16.6-1~deb13u3_amd64.deb
 75480c9195359509cc689e93acacd4de9609a71c8ef7c6777b2f54fe10e1f21c 11025452 flatpak-tests-dbgsym_1.16.6-1~deb13u3_amd64.deb
 08a3ef1498a4b87667344d37f7dd1c86f5f917f03eca3f5bd9604c72a390d418 1452788 flatpak-tests_1.16.6-1~deb13u3_amd64.deb
 23781006c364149842f24ac1733a8d4fb5b6cc382cdf04446c70d849c2b8b609 17698 flatpak_1.16.6-1~deb13u3_amd64-buildd.buildinfo
 7a66bc94d8357cf378e6cb102c4eec44b33f309405664fc14d953cfe7d121e04 1557028 flatpak_1.16.6-1~deb13u3_amd64.deb
 5fec12ef6fe0b789c8b17c32f2525f5fa4e78d49a8641a16841b657a032b18ef 29716 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_amd64.deb
 adc6c0c65540fc24444780eafefa98059554ccd22bb3dac0526f54d67385c3ac 74016 libflatpak-dev_1.16.6-1~deb13u3_amd64.deb
 42f85490233ad1e5a30fd9398456ef156107eedcc5c9c160d75cad4541287142 1767452 libflatpak0-dbgsym_1.16.6-1~deb13u3_amd64.deb
 bb851856951aae3880b8ae0e9925ead07007516640f7cf240e8a539995231eaa 396956 libflatpak0_1.16.6-1~deb13u3_amd64.deb
Files:
 f9cf76056d709eda953ab26c91124914 7718952 debug optional flatpak-dbgsym_1.16.6-1~deb13u3_amd64.deb
 c809f039b3a92aadbb2e1b03782cfa2c 11025452 debug optional flatpak-tests-dbgsym_1.16.6-1~deb13u3_amd64.deb
 23acf5470d3266c968abc17981c9bb6b 1452788 misc optional flatpak-tests_1.16.6-1~deb13u3_amd64.deb
 cc0b682104468833461ec1cc71b1d410 17698 admin optional flatpak_1.16.6-1~deb13u3_amd64-buildd.buildinfo
 1648f9ee1c75efe1bdf278192a070662 1557028 admin optional flatpak_1.16.6-1~deb13u3_amd64.deb
 e005c1e131ca3c60532f54682cb6e177 29716 introspection optional gir1.2-flatpak-1.0_1.16.6-1~deb13u3_amd64.deb
 cad3a07939817481ee67c9ac236cac2d 74016 libdevel optional libflatpak-dev_1.16.6-1~deb13u3_amd64.deb
 0169c45b072f898c2dbbc75aabd5bbee 1767452 debug optional libflatpak0-dbgsym_1.16.6-1~deb13u3_amd64.deb
 e46e02e3fb040419beb0711f77ffd5cb 396956 libs optional libflatpak0_1.16.6-1~deb13u3_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmq6dUoACgkQPkCWRKsh
20ekhA/8DERjxpIK4lu2YibDrnqHQw7gaT9QON1lumLTc3ZSHPFW5Zh/I2pcbk/a
BTIb4iYfW2as0PrdCVf/ctLvO3gihs5rvmmpWysjq3AK8VsLQ+9MEstlRM5wexA+
+u4QxggsIvNjtj5PYjXo9ErcOtwGVt/abxQRnihq3uW+fBOanQb6QsZvcdqc5aqk
alj3BJbQJrpHtHqUY9j70lBJp8VY6yF/LekgqbsCMw453a/YbInMhqIc9FUE/9oA
IlnUMeWs9n+R0ZWF0nCPyLW0rgh19P8spXVGj/i3lJDtVunXpDXktKRvfsdib45O
4SovRReaXHFhAZldhBYWungUCDyYGXOsg3hXdiVAlbQETXhgarhDcYCam8x94rmq
YtTkt9tx2mNgdOm4iUFvTioQFjx2pTZMMCbu8OwOdfjoM7M6ljra8E9zUvn3Ycn1
Vb3nu08RFscWn/BiSi322RoMSBZqhGZqo28QBXQENjQMFxDlefZTJ1V+GHfKYjC3
TuE6fQCTB6QGq9+QXw42nEtfG4q/BQf5ZyOA0859BiI2MuWzpFFLOeqA+RwNiZbG
+BMxod987KVaMuUCV6FG0Glu5FCOTvYlxDl+5hLA++CQP6JoF008NOtHfFsN3O97
NWBRLMmlb0jt9iSz7sqTG0eJzSS64G5NoGpHiOVBu4YWvXJW0dw=
=QRie
-----END PGP SIGNATURE-----