-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym
Architecture: arm64
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: arm64 Build Daemon (arm-conova-02) <buildd_arm64-arm-conova-02@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 flatpak    - Application deployment framework for desktop apps
 flatpak-tests - Application deployment framework for desktop apps (tests)
 gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection)
 libflatpak-dev - Application deployment framework for desktop apps (development)
 libflatpak0 - Application deployment framework for desktop apps (library)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 5c8a48f32fc9edfd99c177214b2407e8940baf50 7641876 flatpak-dbgsym_1.16.6-1~deb13u3_arm64.deb
 0efe4c1e0823341200eef2c535cb23955b1f7aa5 10955488 flatpak-tests-dbgsym_1.16.6-1~deb13u3_arm64.deb
 5b561736d82a8b8da621f7ce9b5fbc3811bd1a18 1322064 flatpak-tests_1.16.6-1~deb13u3_arm64.deb
 8e35a7988cc4e00e785ba7561d9f674e4d568ed8 17688 flatpak_1.16.6-1~deb13u3_arm64-buildd.buildinfo
 319eddad673506c334e1e330eb50d3b76494a010 1480152 flatpak_1.16.6-1~deb13u3_arm64.deb
 d6342528b413406ab351dc8a946211d033c5f1f4 29728 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_arm64.deb
 dc856df9e5d9e370f37b60728dd146ef36afc70e 74024 libflatpak-dev_1.16.6-1~deb13u3_arm64.deb
 03dc32922a064858eabc399e872dc3f6c2950c0d 1751376 libflatpak0-dbgsym_1.16.6-1~deb13u3_arm64.deb
 a74fb45e668e92fdf67dee3817deeca3e5e76650 353640 libflatpak0_1.16.6-1~deb13u3_arm64.deb
Checksums-Sha256:
 82aec9c380651aad127053010cbec15f4dd595e04d032bb993f90591fc2ce705 7641876 flatpak-dbgsym_1.16.6-1~deb13u3_arm64.deb
 4c601808de05e992e4f8cf6dc4cdacb3a0c520dec60ed3fe80ac5f56676b01df 10955488 flatpak-tests-dbgsym_1.16.6-1~deb13u3_arm64.deb
 b21e7fd9e16015810f911bffe74634c704e29cc177d0e15469878c8434695b0f 1322064 flatpak-tests_1.16.6-1~deb13u3_arm64.deb
 76b2b18e4c8717499e507ca13863624679323c72d0c75955be0e81dc872b7a6e 17688 flatpak_1.16.6-1~deb13u3_arm64-buildd.buildinfo
 12fa99754277905154eaf1025d028136ce7a22ce18afa1f637d30b742ef9de26 1480152 flatpak_1.16.6-1~deb13u3_arm64.deb
 1043c914856884699d1ee77603d1e2ba3145bf0a7f879044867c3b2956c703b6 29728 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_arm64.deb
 3aad2db9040e78c35a92d97d267c18470f414e8ab021d669b1c867faa03e25d9 74024 libflatpak-dev_1.16.6-1~deb13u3_arm64.deb
 6bc45b5d617fbb83a76a79438cf34839900c17c705d737dd7cc0deebb46974ad 1751376 libflatpak0-dbgsym_1.16.6-1~deb13u3_arm64.deb
 872aa70172a19bd57282f9488492b80056108700009c029895de1ca626c1c201 353640 libflatpak0_1.16.6-1~deb13u3_arm64.deb
Files:
 c354bb940e5343f498c401845c6cd8c9 7641876 debug optional flatpak-dbgsym_1.16.6-1~deb13u3_arm64.deb
 8f3dda8fa5e01e0016a3fb0478cd055c 10955488 debug optional flatpak-tests-dbgsym_1.16.6-1~deb13u3_arm64.deb
 2cb2a7cc806d11e0f13c29ff1551c606 1322064 misc optional flatpak-tests_1.16.6-1~deb13u3_arm64.deb
 063e203e2f60eb59d98149a27dd913c8 17688 admin optional flatpak_1.16.6-1~deb13u3_arm64-buildd.buildinfo
 24738662a5fd453843dfb3be2dbb4c8c 1480152 admin optional flatpak_1.16.6-1~deb13u3_arm64.deb
 856d7fca2fa47ffae9ef2fda009b44ba 29728 introspection optional gir1.2-flatpak-1.0_1.16.6-1~deb13u3_arm64.deb
 82af31ff81b6dfeb20c1299bc11184f3 74024 libdevel optional libflatpak-dev_1.16.6-1~deb13u3_arm64.deb
 1356e01be62d1dfb387c9d1ed8947a8b 1751376 debug optional libflatpak0-dbgsym_1.16.6-1~deb13u3_arm64.deb
 d67d6739b8cd54dbb6127245ff444005 353640 libs optional libflatpak0_1.16.6-1~deb13u3_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEa5s+5E+WDkV2pQjwIyDMsRzdi8EFAmq6dUsACgkQIyDMsRzd
i8FHzg//Yww17d4hqkmlcNRP4AecuX7O3C5ny3WR2S0lQ49fLd/m1F6SwwYaqVQp
Q+SgK20RmLToXAy04ZVgiP4QsqvsTTrvpViIrio1CJ5dg+r9892zG2PuLPn2Ldza
2b79EYcyWwkiodOSOjrLwcScLjdNbZ6X5wUNguMHCGxafZZHRa0RjRPEE4IKaLGl
5YfB2nmiI2eah4n1X3JqfJ4FpkTTGe4RXkBGNZc4frvIlkSmxFoJcOmSAGdEunmy
+Y5+UCkmPzZ8s6ApDhXAhUwxSb8AgokGl7tYVGCrMpwDmt92VAPHqH4+xHX+EvON
zhSeDVUqzWnXfhqjUMOlzieuu5jLKDoy23DYKfDGuAr5dZEz0J6OFGF7NkjIEvv+
6XDltmp484uAUC+X5BnG/EYl2vHts1s/XR0KiA3B4WOxoIJJupvB57OTs/WpnTde
IuEftNHWEvbyxsVLopzv38LeOcg+YmQ8/EYykJp5GYcPIptkoHNsmjQC+07s8uoO
69M2I+wFvqWQb678cq8vjc15mhcu1Vw3H1e08BjH11hc8mqITGGQRIUNDU6mrD3e
4CXi1/cmB2gvoZ7EfuoRqx0f5b5xM8tIdiqLI0dJcnWbxWKzmRaVnQf4Q1NmmDtg
bKFix5S1fkAciSHenx66yqljAWJgtQphknXI/G9z5aNI8h+K45M=
=Rjdq
-----END PGP SIGNATURE-----