OESA-2026-2709

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2709

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-2709.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-2709

Upstream

CVE-2026-34078

CVE-2026-34079

Published

2026-06-24T13:11:24Z

Modified

2026-06-24T13:30:10.934232677Z

Summary

flatpak security update

Details

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Every Flatpak app is able to read and write arbitrary files on the host and execute code in the host context, resulting in a sandbox escape vulnerability.(CVE-2026-34078)

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete arbitrary files on the host. This vulnerability is fixed in 1.16.4.(CVE-2026-34079)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:20.03-LTS-SP4 / flatpak

Package

Name: flatpak
Purl: pkg:rpm/openEuler/flatpak&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.3-14.oe2003sp4

Ecosystem specific

{
    "noarch": [
        "flatpak-help-1.0.3-14.oe2003sp4.noarch.rpm"
    ],
    "x86_64": [
        "flatpak-1.0.3-14.oe2003sp4.x86_64.rpm",
        "flatpak-debuginfo-1.0.3-14.oe2003sp4.x86_64.rpm",
        "flatpak-debugsource-1.0.3-14.oe2003sp4.x86_64.rpm",
        "flatpak-devel-1.0.3-14.oe2003sp4.x86_64.rpm"
    ],
    "aarch64": [
        "flatpak-1.0.3-14.oe2003sp4.aarch64.rpm",
        "flatpak-debuginfo-1.0.3-14.oe2003sp4.aarch64.rpm",
        "flatpak-debugsource-1.0.3-14.oe2003sp4.aarch64.rpm",
        "flatpak-devel-1.0.3-14.oe2003sp4.aarch64.rpm"
    ],
    "src": [
        "flatpak-1.0.3-14.oe2003sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-2709.json"