[CLSA-2026:1793023823] flatpak: Fix of CVE-2026-97024
Type:
security
Severity:
Important
Release date:
2026-10-26 14:10:33 UTC
Description:
- CVE-2026-97024: fix arbitrary file write during runtime deploy, where a malicious runtime with "files/etc" as a symlink made the path-based passwd/group/machine-id/resolv.conf handling write at the symlink target
CVEs fixed:
Updated packages:
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els3.i686.rpm
    sha:f3d03fc5b867b15123fc9accb499055ee20afc2980803c14faf3cd7981906885
  • flatpak-1.0.9-13.0.1.el7_9.tuxcare.els3.x86_64.rpm
    sha:0271aeaa6886bca3e76f157a0f02e0179bd852fa22d7002900601e76b27ecc45
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els3.i686.rpm
    sha:ee414179b1b7a1623e114b43a1a0c5bcdd50ebf2025f661601c1f20ee46a8099
  • flatpak-builder-1.0.0-13.0.1.el7_9.tuxcare.els3.x86_64.rpm
    sha:c044c4be5b9fa3f163dbb388e23d426bdcb4a4f7f93f96c4413353f9a5259bce
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els3.i686.rpm
    sha:f2fd9e2badc99e6a1c8045120d7980b484c41bdabbbcc3ce89cb0b91aa658377
  • flatpak-devel-1.0.9-13.0.1.el7_9.tuxcare.els3.x86_64.rpm
    sha:9fdc803cb65f026db5c7a042334ade5bbce12abf278ec8b1e86be48a1202af8f
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els3.i686.rpm
    sha:24e5109f75a01202b2c160521aeb98be0681e7fca558032d8f7e230d3b4568da
  • flatpak-libs-1.0.9-13.0.1.el7_9.tuxcare.els3.x86_64.rpm
    sha:1f8f6da9796bff723b662c0d50972591cc99b2315a8039eae013565a52783ef5
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.