SUSE-SU-2026:5127-1

    Dashboard / Vulnerabilities / SUSE-SU-2026:5127-1

    SUSE-SU-2026:5127-1

    Published: 6 Nov 2026Last Modified: 7 Nov 2026

    Summary: Security update for flatpak

    Details: This update for flatpak fixes the following issues: - CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options (bsc#1261769). - CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation (bsc#1261770). - CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host (bsc#1280236). - CVE-2026-92162: path traversal via unvalidated `arch` parameter in `DeployAppstream` (bsc#1282514). - CVE-2026-96275: arbitrary write access as root via extra-data extraction (bsc#1282515). - CVE-2026-96276: arbitrary write in host context via `flatpak build-init` (bsc#1282516). - CVE-2026-96280: buffer overflow in OCI delta stream path names (bsc#1282518). - CVE-2026-96281: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes (bsc#1282519). - CVE-2026-96282: extension metadata path traversal file existence oracle (bsc#1282520). - CVE-2026-96807: fixed-filename writes to arbitrary locations via symlink attack on `.ld.so` (bsc#1282523). - CVE-2026-96808: `revokefs` symlink path traversal allows local privilege escalation via commit tampering (bsc#1282524). Changes for flatpak: - Update to version 1.16.6 (jsc#PED-17048): + Fix file descriptor leaks affecting Chromium-based browsers. + Fix installing extra-data without a runtime, including OpenH264. + Ignore unusable sandbox-expose paths for portal sub-sandboxes, fixing Epiphany regressions. + Fix installed tests and handling of standard file descriptors passed as invalid flatpak run arguments. - Switch from Autotools to Meson, preserving system bubblewrap, xdg-dbus-proxy, curl and distribution-specific installation paths. - Require bubblewrap >= 0.10.0 and GPGME >= 1.8.0; add Meson, gettext, gtk-doc and polkit-agent build dependencies and drop obsolete intltool and libelf build dependencies. - Generate the system-user pre-script from the Meson build directory and package the tmpfiles configuration and renamed manual pages.

    References: https://www.suse.com/support/update/announcement/2026/suse-su-20265127-1/, https://bugzilla.suse.com/1261769, https://bugzilla.suse.com/1261770, https://bugzilla.suse.com/1280236, https://bugzilla.suse.com/1282514, https://bugzilla.suse.com/1282515, https://bugzilla.suse.com/1282516, https://bugzilla.suse.com/1282518, https://bugzilla.suse.com/1282519, https://bugzilla.suse.com/1282520, https://bugzilla.suse.com/1282523, https://bugzilla.suse.com/1282524, https://www.suse.com/security/cve/CVE-2026-34078, https://www.suse.com/security/cve/CVE-2026-34079, https://www.suse.com/security/cve/CVE-2026-90616, https://www.suse.com/security/cve/CVE-2026-92162, https://www.suse.com/security/cve/CVE-2026-96275, https://www.suse.com/security/cve/CVE-2026-96276, https://www.suse.com/security/cve/CVE-2026-96280, https://www.suse.com/security/cve/CVE-2026-96281, https://www.suse.com/security/cve/CVE-2026-96282, https://www.suse.com/security/cve/CVE-2026-96807, https://www.suse.com/security/cve/CVE-2026-96808

    Affected packages

    Package

    Name: flatpak

    Purl: pkg:rpm/suse/flatpak&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.16.6-150500.3.21.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2026:5127-1 | CVE-DB