-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym
Architecture: s390x
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: s390x Build Daemon (zani) <buildd_s390x-zani@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 flatpak    - Application deployment framework for desktop apps
 flatpak-tests - Application deployment framework for desktop apps (tests)
 gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection)
 libflatpak-dev - Application deployment framework for desktop apps (development)
 libflatpak0 - Application deployment framework for desktop apps (library)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 9e911e493acd6c33d3d6dfd5b7544e9812c71d60 7380784 flatpak-dbgsym_1.16.6-1~deb13u3_s390x.deb
 7f945f807398b6d84847aaaad08e555ca10042a7 10520572 flatpak-tests-dbgsym_1.16.6-1~deb13u3_s390x.deb
 141f4a86c9c8c7570e77745c2f3597927244937b 1330192 flatpak-tests_1.16.6-1~deb13u3_s390x.deb
 b99ac0d05e7309c8e974197eee981d2cfadc8f61 17505 flatpak_1.16.6-1~deb13u3_s390x-buildd.buildinfo
 8fa369457f331b99f1333c4f25a196d5a32b68eb 1469476 flatpak_1.16.6-1~deb13u3_s390x.deb
 0e3a967e3617b4a5f8cd803d5f5f87949b13b613 29596 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_s390x.deb
 48d7da9de44ff4b850ed33df68a86d9ff91e5e73 74032 libflatpak-dev_1.16.6-1~deb13u3_s390x.deb
 a37494b359181970af81f283c3d41fa64b8a6420 1749748 libflatpak0-dbgsym_1.16.6-1~deb13u3_s390x.deb
 71f7f4f76f5be181e7e037b821a30d8316a09e19 369920 libflatpak0_1.16.6-1~deb13u3_s390x.deb
Checksums-Sha256:
 b121611d751566c7ea3c55a9abbff0c75a53fecc043d7506f09c6153adecff4e 7380784 flatpak-dbgsym_1.16.6-1~deb13u3_s390x.deb
 d9d6061b0d9270f808d964c0762b368672a53b38ec889bfd5434d72dde12f3ec 10520572 flatpak-tests-dbgsym_1.16.6-1~deb13u3_s390x.deb
 b171eb1edfd758a2925644ed433782bc4a7fe332450089770c8e2d361f28b488 1330192 flatpak-tests_1.16.6-1~deb13u3_s390x.deb
 8723f889adbd31ce236b56b65bf529f8815b67041387e58d0c59c240d7c6d664 17505 flatpak_1.16.6-1~deb13u3_s390x-buildd.buildinfo
 ca88e66bc3391d197fa9a4947d97a801da020e627818f4793b4b854b8ec1b0ae 1469476 flatpak_1.16.6-1~deb13u3_s390x.deb
 d2cfe2748570d3b0ab7cc906a499247a334cbb8dd1ee6d868b36104af0b32667 29596 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_s390x.deb
 ed63ec18303c740768c5c00fd3f1339c41b521bd4805da0b722d48641191cb4d 74032 libflatpak-dev_1.16.6-1~deb13u3_s390x.deb
 fad03c79d65490250ce037c82eee1d072b17f1a079303b6612ef825a634d7d3f 1749748 libflatpak0-dbgsym_1.16.6-1~deb13u3_s390x.deb
 6ea14c5c9bbfec2c5077ab18ad3841f36584d11dc7e9c46d4faf1ef287bfe5f7 369920 libflatpak0_1.16.6-1~deb13u3_s390x.deb
Files:
 761df8e6bda171be3bd8aae6bd443645 7380784 debug optional flatpak-dbgsym_1.16.6-1~deb13u3_s390x.deb
 abb28af59db61b2a7bf3e466cf2cdaf3 10520572 debug optional flatpak-tests-dbgsym_1.16.6-1~deb13u3_s390x.deb
 ac428d24e41ee75e63a9c8209e9f0a0d 1330192 misc optional flatpak-tests_1.16.6-1~deb13u3_s390x.deb
 2f323842fce068bfd1d2939764ee917b 17505 admin optional flatpak_1.16.6-1~deb13u3_s390x-buildd.buildinfo
 bb9510f72fd22c2f3e3809913d6449a1 1469476 admin optional flatpak_1.16.6-1~deb13u3_s390x.deb
 a0ec28cf3a87adc7ca8166265b68af60 29596 introspection optional gir1.2-flatpak-1.0_1.16.6-1~deb13u3_s390x.deb
 a3c342f5e262884653d0c648cb340c3f 74032 libdevel optional libflatpak-dev_1.16.6-1~deb13u3_s390x.deb
 82b7bbcc07733a78b04699a9727072ef 1749748 debug optional libflatpak0-dbgsym_1.16.6-1~deb13u3_s390x.deb
 37356267a57ea7a7997d0cc74a66af2e 369920 libs optional libflatpak0_1.16.6-1~deb13u3_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfUKc1SwkyxlVJBiWHOd5r2LlPicFAmq6dRwACgkQHOd5r2Ll
PidqHhAAllx8nOvDP4X73jJDAcBG/vdK0wHwy+TDTatjzitRJ3hwpMQJ6jo4kco6
8iZxwhZgxqPZufF1uB//r/nqUwGTgMigbD1KbGrbrrRx3ub0c7pgMFxXnL0Hg5c2
Ly/z55RbJvnNeDHd2W3wgNeHM/FGfrIZwl337codg5wZKQVgVsvSk9rPvJEu8CE+
/OPuOxvWRKx7Q8ZWAoL5+aTirxbVASx7Isav8cwlBTonkZg8tZXWdkbeoZVb7LtL
vVfdppOMfrXAcJvaq+fxj58bNQUqT07gpawP+HnjG50rxinOsa8Y1BIZQoc9O9M2
U5FBhtMGXAZW+CWb+tyO3gBrcQAB7WlJQO4ooZY4gWlsdmJYuh/S3OisSNQskXL8
jaGpkOJzp8pRW0NbLQlSB5d06lug4fulFyEf1aLN3wHJDjxPdE02VNqqc1K0jEzF
R49BJuqskEzqkT6v6WYhUr7/DqZ+eCDAOpc2XMfxn5/SHBO6+3ie96VJm/dSo3gH
gW97jTVmuGkEExRYlPfLp7yK4xGggvJG3YbSSWQ7BJNaAJLViXrV7dBVTnApwd6e
SrM21i8hhCjwpO7JsvUkgzTHLPDlRLhUOdf2tx1foQlygZ9b7p9/LXfL4Y0z6ucU
GcRxGKtNCtrSZkPCChTrw5HL1/QvyWf3nmMf9DzOBbSrGIecJpQ=
=3a20
-----END PGP SIGNATURE-----