flatpak-1.12.9-4.el9_8.1
エラータID: AXSA:2026-1286:03
リリース日:
2026/07/19 Sunday - 12:41
題名:
flatpak-1.12.9-4.el9_8.1
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Flatpak ポータルの sandbox-expose オプションの処理には、
シンボリックリンクの解釈処理に問題があるため、リモートの攻撃者
により、巧妙に細工されたシンボリックリンクの設定を介して、
セキュリティ機能を迂回し、任意のコードの実行を可能とする脆弱性
が存在します。(CVE-2026-34078)
- Flatpak の ld.so のキャッシュ機能には、古いキャッシュファイル
へのパスが指定されたキャッシュディレクトリ内であることのチェック
処理の欠落に起因して意図しないキャッシュファイルを削除してしまう
問題があるため、ローカルの攻撃者により、任意のファイルの削除を
可能とする脆弱性が存在します。(CVE-2026-34079)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-34078
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.
CVE-2026-34079
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.
追加情報:
N/A
ダウンロード:
SRPMS
- flatpak-1.12.9-4.el9_8.1.src.rpm
MD5: d794dd6f32b9b7059ce2c5e435147153
SHA-256: 9e1811fa76b026e1a046e5ad7bf575338a4aa2c4884f1f5afd23c2ca07c41a73
Size: 1.61 MB
Asianux Server 9 for x86_64
- flatpak-1.12.9-4.el9_8.1.i686.rpm
MD5: 076375c9b405ee4e01343c2f62b83972
SHA-256: 17dac1d62942b8ba18c5bb09fd29cf941630609c99660e79828f464c819aa124
Size: 1.78 MB - flatpak-1.12.9-4.el9_8.1.x86_64.rpm
MD5: 0300af12950e30892193f206d5e02f85
SHA-256: 8d57604d510ca8128ebf4e83eb36823a08b862e8cf7af9c8e34eb8d4ebf2a91c
Size: 1.72 MB - flatpak-devel-1.12.9-4.el9_8.1.i686.rpm
MD5: d0ca8c89152e95246ec5431fd041b00e
SHA-256: 741782e4da5dc8d5103a5e042f421ec14887f50ed99ff8f6007ac52c4d29626e
Size: 117.80 kB - flatpak-devel-1.12.9-4.el9_8.1.x86_64.rpm
MD5: 0b619db81ce527394a313938aa4ca305
SHA-256: 7586225dbb8115193c1f5100b62c942ffe6c14315a41d41290e246dc1a6fb83c
Size: 117.75 kB - flatpak-libs-1.12.9-4.el9_8.1.i686.rpm
MD5: 76630dd9cef0fa47706ebedec0c80ae9
SHA-256: ce57e4052c78db6f9b09b43e310a2b34cae6e21958958260a766ef0e39a6fbbd
Size: 527.66 kB - flatpak-libs-1.12.9-4.el9_8.1.x86_64.rpm
MD5: 1e62c5f845718419b1e06040a76abfba
SHA-256: 38e659a7283456d688089d36230bc42acfbc9fe200028918db7e5a245f49dd7d
Size: 504.75 kB - flatpak-selinux-1.12.9-4.el9_8.1.noarch.rpm
MD5: 4ac0c19c7e75c57cb25e858cb48c3f3f
SHA-256: 9459c619e47ca06a2bb473ec8aa672eaa1a8ae48abd5dfb237b84efb00760649
Size: 21.00 kB - flatpak-session-helper-1.12.9-4.el9_8.1.i686.rpm
MD5: 9c7ebc789a878403a9430f57ce7ccfd8
SHA-256: 1b8a41c9359f7da8f509be57284cbab3e0462a01477a396d658539031cdf4037
Size: 74.03 kB - flatpak-session-helper-1.12.9-4.el9_8.1.x86_64.rpm
MD5: 4cd86b83febfbb912114b2ac9d797e8d
SHA-256: 461dce1f0f6acd0dd92ed7601c551b428907741e4e768677e9932409d36f44a4
Size: 72.51 kB
English