SUSE-SU-2026:4944-1

Dashboard / Vulnerabilities / SUSE-SU-2026:4944-1

SUSE-SU-2026:4944-1

Summary: Security update for flatpak

Details: This update for flatpak fixes the following issues: - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236). - CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515). - CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516). - CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518). - CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519). - CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520). - CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523). - CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524). Changes for flatpak: - Update to version 1.16.6 (jsc#PED-17048): + Fix file descriptor leaks affecting Chromium-based browsers. + Fix installing extra-data without a runtime, including openh264. + Fix unusable sandbox-expose paths affecting Epiphany. + Fix installed tests and handling of file descriptor arguments. - Changes from version 1.16.5: + Fix regressions from the sandbox escape security fix affecting browsers, browser-based apps and Steam. + Expand test coverage of flatpak-run features used by the portal. - Changes from version 1.16.4: + Prevent arbitrary file reads in the system-helper context (GHSA-2fxp-43j9-pwvc). + Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg). - Changes from version 1.16.3: + Be selective about mapping font-dirs.xml in flatpak build. - Changes from version 1.16.2: + Support reinstalling bundle installations and Intel Xe VA-API. + Add cancellation support for curl downloads. + Fix font configuration, mask and pin configuration reloads, unintended home directory access, flatpak kill, OCI support, memory leaks and crashes. - Changes from version 1.16.1: + Allow updating existing apps under parental controls by default. + Use instance IDs for systemd scopes and include /dev/udmabuf with --device=dri. + Speed up prune --dry-run and permission-reset. + Support TLS certificates in /etc/containers/certs.d for OCI. + Fix portal crashes, sandbox environment handling, accessibility bus discovery, error reporting and shell completion. + Update documentation and translations.

References: https://www.suse.com/support/update/announcement/2026/suse-su-20264944-1/, https://bugzilla.suse.com/1280236, https://bugzilla.suse.com/1282514, https://bugzilla.suse.com/1282515, https://bugzilla.suse.com/1282516, https://bugzilla.suse.com/1282518, https://bugzilla.suse.com/1282519, https://bugzilla.suse.com/1282520, https://bugzilla.suse.com/1282523, https://bugzilla.suse.com/1282524, https://www.suse.com/security/cve/CVE-2026-90616, https://www.suse.com/security/cve/CVE-2026-92162, https://www.suse.com/security/cve/CVE-2026-96275, https://www.suse.com/security/cve/CVE-2026-96276, https://www.suse.com/security/cve/CVE-2026-96280, https://www.suse.com/security/cve/CVE-2026-96281, https://www.suse.com/security/cve/CVE-2026-96282, https://www.suse.com/security/cve/CVE-2026-96807, https://www.suse.com/security/cve/CVE-2026-96808