-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym
Architecture: armel
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: armel Build Daemon (arm-ubc-03) <buildd_arm64-arm-ubc-03@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 flatpak    - Application deployment framework for desktop apps
 flatpak-tests - Application deployment framework for desktop apps (tests)
 gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection)
 libflatpak-dev - Application deployment framework for desktop apps (development)
 libflatpak0 - Application deployment framework for desktop apps (library)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 9c6add4cba46d8a4f9e433a4c0d35c4455e1d0bb 7228332 flatpak-dbgsym_1.16.6-1~deb13u3_armel.deb
 96862e0c88090b8b79d2e9cb39f518cd71793856 10294964 flatpak-tests-dbgsym_1.16.6-1~deb13u3_armel.deb
 0623f8ae7ee39a1afeaba151fd2c248129c8f439 1161156 flatpak-tests_1.16.6-1~deb13u3_armel.deb
 391b16b6ffe1baa5b7ec6880678186c8a8d4b4dc 17550 flatpak_1.16.6-1~deb13u3_armel-buildd.buildinfo
 0af6f8c3f3146833d32a89a2904214a04fb03fe6 1375572 flatpak_1.16.6-1~deb13u3_armel.deb
 b5e6e5de9558968ae24dd02a60a3785a6cee8a80 29716 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_armel.deb
 4a37304a614a594acdbb0b1acd1247a6629049bb 74040 libflatpak-dev_1.16.6-1~deb13u3_armel.deb
 9f4477de6a6d457731a68dc3723514eeb2d53ade 1720212 libflatpak0-dbgsym_1.16.6-1~deb13u3_armel.deb
 7fcd4cec4e9541563e4289365bdee6ddf61df832 334284 libflatpak0_1.16.6-1~deb13u3_armel.deb
Checksums-Sha256:
 acfdcad4ebff40cb12f08c10686a470f53c6d226ca942560bea0415c95c7c19d 7228332 flatpak-dbgsym_1.16.6-1~deb13u3_armel.deb
 acf42bf4f98db3b6b09a278748ab6c23a74a1a89200bb82c70747d5c2849b1de 10294964 flatpak-tests-dbgsym_1.16.6-1~deb13u3_armel.deb
 9259d5a5de61270c5a68689ade37d3ff09a1da964e217930c3dd87da7e7f792a 1161156 flatpak-tests_1.16.6-1~deb13u3_armel.deb
 c605fcc6566ba3b0dbf327eb9ce49e9125df13537fab5b50b0634cc1161825b7 17550 flatpak_1.16.6-1~deb13u3_armel-buildd.buildinfo
 2df0f9519345143375bd16365fea6c71547ac4e840ad8fb59e658af36fa792c9 1375572 flatpak_1.16.6-1~deb13u3_armel.deb
 3a2221e200270ec74ded6d1162b89df5be6092d08bc7db5d027cbba0b94288bd 29716 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_armel.deb
 679f13a5e7cb4b2db3851cf312abb70177e02d2d93125f9f9c3007c373992089 74040 libflatpak-dev_1.16.6-1~deb13u3_armel.deb
 64f0290bc5663821a5e8a044b4563df4a5564db00baa61f7eb1e143d1625fd5d 1720212 libflatpak0-dbgsym_1.16.6-1~deb13u3_armel.deb
 a185fe8457098c8c02780176cf21be0569c7520cf910639b84e6643fd3a2e6ae 334284 libflatpak0_1.16.6-1~deb13u3_armel.deb
Files:
 77f91f1fe13f777ff061f9934d61776b 7228332 debug optional flatpak-dbgsym_1.16.6-1~deb13u3_armel.deb
 6aa08d0b063f64d15f0d9126d2a9c360 10294964 debug optional flatpak-tests-dbgsym_1.16.6-1~deb13u3_armel.deb
 7e4e1c47c77ca88f1f24b0a48699f0d6 1161156 misc optional flatpak-tests_1.16.6-1~deb13u3_armel.deb
 9e0721b0ba975ab62080a3ea290dd433 17550 admin optional flatpak_1.16.6-1~deb13u3_armel-buildd.buildinfo
 0bf14f04d0c5d4c4fb094b62db5b4c49 1375572 admin optional flatpak_1.16.6-1~deb13u3_armel.deb
 b3fdd3c4873d5d61e52d830aae475d68 29716 introspection optional gir1.2-flatpak-1.0_1.16.6-1~deb13u3_armel.deb
 7aa9675afc734a91c4bf477e6f0bc9e4 74040 libdevel optional libflatpak-dev_1.16.6-1~deb13u3_armel.deb
 b221204febcf1f829c8da2925ed63b1a 1720212 debug optional libflatpak0-dbgsym_1.16.6-1~deb13u3_armel.deb
 48f65a701904027d082554a24ce6b7d2 334284 libs optional libflatpak0_1.16.6-1~deb13u3_armel.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE2kd8oHy+LXk/nybqvzDqKQSGl8UFAmq6dW8ACgkQvzDqKQSG
l8U1aBAAust+04jyT618bN5afpXdcx+DdwjwwnEBq6Y/I+rjB1jWYwSwi8+vQj86
1TmBw6dkXbqViA2pI+vrt+gdzuRc0H215qZLJkpqECoeKUU+byZgxYFgHHAvfibU
gAnhi1a2dIvJa86Nh/8eREE7U2Iv8pFsXMaR+d8H6fFVE4mGZyK4S7RkDawvC2b5
PUSPwpfyNRm8Qq/0Y5gCvvyjtF22vJpLjOF1ZkVPGO9t+iv+fd+Y8ThqpJoEhqFy
ugBmHEN5aQA10q7IzPpFV+rFDCk06hxQbOJYTcamd/5EyTn+RlUcPresu4/uAaWJ
nJSmCtGAgA5KSLbKgbQL9PNC6dMLFONBpiMWIYNBuhnqIdXJLk2+qAkn2ZftblXC
kaAgVQt2Xvuxzqz/NR2WcMY7l1gxdlCDvtmCKFiQSCmZ5uqOrD8NWea1nnVh4qYE
wQSWB1284vnOzOwptdbKkn1725KN+MRJDDqVeDkHci4+qdP2Dx89zX+zIrLIUxL8
IiTcB28Ecn14DwBHna4J+3RoILCPHYkO479yJKIy6lvyovns+gufPCAATxG33CZ7
3Z+1noTN8Xmb9+UCqor4UUKXufcRR0bFCeI1KBw9pSTxDyDTGQ3UiRJZB6AfMC18
mqsX3+9GYDrlEWSpOgqr4xYP+FXqDXw4cuDwTF3XIqo8EBAL9pM=
=Yvvp
-----END PGP SIGNATURE-----