-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 28 Sep 2026 14:13:01 +0100
Source: flatpak
Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym
Architecture: ppc64el
Version: 1.16.6-1~deb13u3
Distribution: trixie-security
Urgency: high
Maintainer: ppc64el Build Daemon (ppc64el-osuosl-02) <buildd_ppc64el-ppc64el-osuosl-02@buildd.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Description:
 flatpak    - Application deployment framework for desktop apps
 flatpak-tests - Application deployment framework for desktop apps (tests)
 gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection)
 libflatpak-dev - Application deployment framework for desktop apps (development)
 libflatpak0 - Application deployment framework for desktop apps (library)
Closes: 1149218
Changes:
 flatpak (1.16.6-1~deb13u3) trixie-security; urgency=high
 .
   * d/patches: Backport security fixes from 1.18.4 (Closes: #1149218):
     - Fix two related symlink traversal vulnerabilities to prevent arbitrary
       file deletion and limited file overwriting outside the deploy
       directory, and harden related code paths against symlink traversal
       (deletion: CVE-2026-97023, GHSA-5p67-xh8x-rq54)
       (overwriting: CVE-2026-97024, GHSA-8xgq-v545-vgvf)
     - When using OCI remotes, don't make authentication token readable by
       other users
       (CVE-2026-97025, GHSA-7rvf-rqr3-43j4)
     - Restrict permissions of temporary directories /var/tmp/flatpak-cache-*
       (CVE-2026-97026, GHSA-r9w3-qx54-qvc8)
     - Filter D-Bus .service files and freedesktop.org .desktop files
       with an allowlist to prevent denial of service and possibly
       sandbox escape
       (CVE-2026-97027, GHSA-v64f-hrwr-j4vh)
     - Prevent sandboxed processes from killing a parent process outside the
       sandbox
       (CVE-2026-97029, GHSA-f3p8-vr7v-gxf2)
   * Mention CVE-2026-90616, CVE-2026-92162 in previous changelog entry
Checksums-Sha1:
 c21051691b8cf413439c8885f3927caaed3a4bc5 7636440 flatpak-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 414346598aef00acc082529ccf0119ac8415ada0 10901440 flatpak-tests-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 8a6b0156fae929a7806eebf7bc087d6dc78552b0 1501448 flatpak-tests_1.16.6-1~deb13u3_ppc64el.deb
 185b75d2153891a1c6d069cc126fb60e97719231 17733 flatpak_1.16.6-1~deb13u3_ppc64el-buildd.buildinfo
 f02c1e030c18a33fd89b2bcb16c854dda2474a2a 1584116 flatpak_1.16.6-1~deb13u3_ppc64el.deb
 41cd73bb8c0cc1fb20c31fb59328ce97bf0b0b16 29728 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_ppc64el.deb
 55d3c0f06ddbad5e861ae20a0c5e2a629bb73abc 74044 libflatpak-dev_1.16.6-1~deb13u3_ppc64el.deb
 cacd544d4700c0cf7d21d74a465678914e4f5318 1810852 libflatpak0-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 a7e4021557f6ab9b512ecc8c01180a9bf7246d99 417020 libflatpak0_1.16.6-1~deb13u3_ppc64el.deb
Checksums-Sha256:
 3c572e7b8d7b653ab41349a15850a7718ef8c230da44f9ec3c790afff7520868 7636440 flatpak-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 371bdb185c1dd6139be6aaf2c4f83c7f0ae0558354045883fb6c50cccf85370e 10901440 flatpak-tests-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 b08c4d195dcd0e9f4384cf0bc8f9eee4cee1177c493531c03748d30377e54c65 1501448 flatpak-tests_1.16.6-1~deb13u3_ppc64el.deb
 37d3623c19548965da1e42b9ac35879ca9824e31d9033cb50aed9e4df0e4d5c2 17733 flatpak_1.16.6-1~deb13u3_ppc64el-buildd.buildinfo
 335a8588e7d211f2e6b45fb9fda0aa0257109ff37037960f60ff897487952561 1584116 flatpak_1.16.6-1~deb13u3_ppc64el.deb
 0205504289d9178b39b5f3bb3f998fe9bf90327e22e379218d2764782c621cce 29728 gir1.2-flatpak-1.0_1.16.6-1~deb13u3_ppc64el.deb
 0b735f8a69ae1539df966e826133ab019e4925fe80a15fb3e7d2e6c60f7c9841 74044 libflatpak-dev_1.16.6-1~deb13u3_ppc64el.deb
 39dd1d8dcc245feef3b87674a10cdb9e28a55cc9aeeee50cdca391f0b52143e9 1810852 libflatpak0-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 73bb19270465bc694145e25453a3f6b865fae8f36242e5c3338e819897acd35b 417020 libflatpak0_1.16.6-1~deb13u3_ppc64el.deb
Files:
 cdbe362a0c8e61230838031bc063510d 7636440 debug optional flatpak-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 9bb6c2ece866234b2a7ea1e58f0d0676 10901440 debug optional flatpak-tests-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 d9e1c15f798b7c9b2d59e3cb238cfa26 1501448 misc optional flatpak-tests_1.16.6-1~deb13u3_ppc64el.deb
 f87e4386fcb53d2ab1f761b793daab2c 17733 admin optional flatpak_1.16.6-1~deb13u3_ppc64el-buildd.buildinfo
 617eb1ed2b7bdcdfd93e40b67f525d91 1584116 admin optional flatpak_1.16.6-1~deb13u3_ppc64el.deb
 77ba48b5341a90b0e9a9e28aba8d4e78 29728 introspection optional gir1.2-flatpak-1.0_1.16.6-1~deb13u3_ppc64el.deb
 2a43f3ae8e423cfdd7e12b6ef9a2613f 74044 libdevel optional libflatpak-dev_1.16.6-1~deb13u3_ppc64el.deb
 fdc471cecbd937c497d7927bafe87a1f 1810852 debug optional libflatpak0-dbgsym_1.16.6-1~deb13u3_ppc64el.deb
 46baa7f9d7994cda30d69762237bf87f 417020 libs optional libflatpak0_1.16.6-1~deb13u3_ppc64el.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE9ibmwdV9gdKNbK7oV8ucRsMTpuMFAmq6dVsACgkQV8ucRsMT
puPBaQ//TriY/y9Ygr7j3jk3/uG8Ciy+jhCs/eBtYB3eKtvh9YyDK9JptAYCLe5t
HPNIP65XMfEUP8OaG17apoTWIr1j1QuaZBYuFSh3Hv0x8MJ7EMNFsNDAQo7XMAcV
p2LMBQdysbZnaI2uAGjAjsGwrUpnIq9cd8fOlGaRpFXuNamN4RwcpP9Gi9xsGxCc
OKsAItL5LVttvOUpewwLzD0XYNtf8myUZscxCmVyd9vx4deZvHWiyWESR03ZVU9h
NsIniJJgDOivN8rXJ8J3pi1EYpZbjJNbF/I838HunDnk4ExVfmcsltmgGpldLcTK
VaXwqGB+d6ag4RzSf+zHcly33qh0AtW/f+FSbiDIQgOM6qsohk8m1UsT/gfVvyZ8
ax75XGKJAeJDBIbZm4u1lOW0FUYzvy5Mgz7xb1++ISTJxoyDihOBDj5CMHYz31V6
y8lWoRJQapmfacbbXPGXE52YOZKlIVKCyFLn4Fu9ok2aIMA8CLn/et5p40hd1pNr
hFZiRX0az2tNnvvxiBcl1VAingsP9RDM3rT1+on9TN0N05FRlAk3MqDNoCjhCeV6
WuMTEo1fhHUtlpRe1QkEEPifgkGZgP/uZO57Kk8uE6OIahpcU6LBYzGyYGGUJ+Kn
r57E6p+noEjSprQuPzNFTjaYbZGsUdgRfqwqzqKh01x7uPu1XCU=
=DI5C
-----END PGP SIGNATURE-----