-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym
Architecture: riscv64
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: riscv64 Build Daemon (rv-osuosl-04) <buildd_riscv64-rv-osuosl-04@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 flatpak    - Application deployment framework for desktop apps
 flatpak-tests - Application deployment framework for desktop apps (tests)
 gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection)
 libflatpak-dev - Application deployment framework for desktop apps (development)
 libflatpak0 - Application deployment framework for desktop apps (library)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 f9e7bd93a99d9fa4fe63b6a4a5fe70643f69ec3e 7106148 flatpak-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 620c2903f83f41c07c7e19ef413f9713815295cc 10128864 flatpak-tests-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 1893faad629d1ba407094b72aba1c9f0d4dd9434 1446720 flatpak-tests_1.16.6-1~deb13u3_riscv64.deb
 37b1e36786436599e09e161cfe9487cbbaefe419 17704 flatpak_1.16.6-1~deb13u3_riscv64-buildd.buildinfo
 9cbb934496453ee7637869326933fcb3e4050575 1560280 flatpak_1.16.6-1~deb13u3_riscv64.deb
 3943c1c3469ea3e0d04c33939d02fa45e81772a5 29724 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_riscv64.deb
 e38dd1a2ed1d48bc474f686372e78d43401662c0 74036 libflatpak-dev_1.16.6-1~deb13u3_riscv64.deb
 3dbe6fe238e6429e27fedc3a0ddc55b42036ee79 1631576 libflatpak0-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 6c782eef6ffa55e87485844b1e253ff2046c3edd 394868 libflatpak0_1.16.6-1~deb13u3_riscv64.deb
Checksums-Sha256:
 ad8e7a89ef73fa9b5aaaf4ac9ecc63cc8f2de96f33a1850ab84ea45ba16deb1b 7106148 flatpak-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 23bfc092f6c07db31f04a28af201ff7162ccf2bd91ed5450a758e2d26fc5cfa6 10128864 flatpak-tests-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 d9d4773e41a2796ac2d0926b9f2879e727287c53dc55c0734c034e0d219c83be 1446720 flatpak-tests_1.16.6-1~deb13u3_riscv64.deb
 76a627b835389cd296e2f7f9ee9e920581cf680f935102a36eeac90701c842a2 17704 flatpak_1.16.6-1~deb13u3_riscv64-buildd.buildinfo
 e65df2ecc36d4a267d4e707b9ffcb4a823f04381c7ec6f203459a3704ae86dab 1560280 flatpak_1.16.6-1~deb13u3_riscv64.deb
 ea94b806819e3758d0bd12f1d15fce9093f90d5ab198d86671e156257433d88c 29724 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_riscv64.deb
 41a18f9565e2d8f03c2e22def894f99d2be9050a2bc8ca632e24db162fcb4fd0 74036 libflatpak-dev_1.16.6-1~deb13u3_riscv64.deb
 ed74ab263fcf693824960a1f1ffc2b1cb62c76d03c5c0453c8ad83673f1bd813 1631576 libflatpak0-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 e062d92dcacdf557089a07ae489dc75ab0ee9ffeb4a99df1186ba43201e295d4 394868 libflatpak0_1.16.6-1~deb13u3_riscv64.deb
Files:
 c387256a8f5f0e5f3726a4f1d1138fda 7106148 debug optional flatpak-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 8e54fda9c96aab64de4225598e2a3409 10128864 debug optional flatpak-tests-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 49c5d5a72aa0e3e72b0916689cc8ea80 1446720 misc optional flatpak-tests_1.16.6-1~deb13u3_riscv64.deb
 a35ec241619012b5af0769c50eef1566 17704 admin optional flatpak_1.16.6-1~deb13u3_riscv64-buildd.buildinfo
 c46719b8d6f2c6703a2ddea34096df07 1560280 admin optional flatpak_1.16.6-1~deb13u3_riscv64.deb
 773ebda5c00718d34fe7f15e77c04f8c 29724 introspection optional gir1.2-flatpak-1.0_1.16.6-1~deb13u3_riscv64.deb
 6363678126468d81b52e15c0410d0ccd 74036 libdevel optional libflatpak-dev_1.16.6-1~deb13u3_riscv64.deb
 df91eff25795ab610446fae50ade6830 1631576 debug optional libflatpak0-dbgsym_1.16.6-1~deb13u3_riscv64.deb
 b29c57438021ab79ccd0ec131bf8c71b 394868 libs optional libflatpak0_1.16.6-1~deb13u3_riscv64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgLDDByWcR07HDSHyNVgvumj7+mMFAmq6lFgACgkQNVgvumj7
+mOIFw/+KbAPKmXV4KJrxjXN30nmAUJ387x7C+/eYzXd9EMlG4L/emI3jAKubA/p
pwWrKX/WvIXhtzxw4gbvrHMi89DMKSPbNS7G4ExRUyDe33QYBIeS44uvigCtaijq
Vlqc9RaLA+yyOgZBJOhJsRDVDyCm8HAK07KAFWUjCXLq8BQ7QwNPizqbC0sbnSly
YuDZgBwz3vk6/37Lwt0zIDZiMXyMGxtLyw3WAAi4j9VYnFhVZB5zRWuCKmCdjdaI
Im2Zqd4NHT77fgc0iYkt8WSqzWcxyqM3d+MQU8iOZYZTJD/QDEOYwPtx/x5tuzE6
G1aJ/qPshzLPpUEMCrHaKSfwqyaZEHP/o3X65MFebpoPbFKnJ+nDIrmo715+x2qR
YQkm9hrCJHfcvsYz+mDC2I6cUhL5UTYI/IZb3cZ/HtriHMDyxb5krKM2xXLZVwZg
8SCZ12XygaGjXLRYqQ5Lv4fdHxVWzh47W5LV/T+LLjqU+Chajm9oWq+tZ7X/mAeu
bKAHOgs8LyzQ54z8FUAPcH5OKTgj8PBSH/wd739lxSNoerlAC7Avk6Dqyf/5PeJJ
DxkWw6EQRNUgOK+kSuBw41oaePbM2kxKmETyI9tTMvEW/1P/TnPg+uqDvMzIsHh6
8bjBqb3lluo8AEeFkjTQDcbqxiOWgGq2/Hdk92L3Wu2lbmq/2z4=
=paHF
-----END PGP SIGNATURE-----