UbuntuUpdates.org

Package "flatpak"

Name: flatpak

Description:

Application deployment framework for desktop apps

Latest version: 1.6.5-0ubuntu0.3
Release: focal (20.04)
Level: security
Repository: universe
Homepage: https://flatpak.org/

Links


Download "flatpak"


Other versions of "flatpak" in Focal

Repository Area Version
base universe 1.6.3-1
updates universe 1.6.5-0ubuntu0.3
PPA: Mint Import 1.0.3-flatpak1~xenial

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.6.5-0ubuntu0.3 2021-05-12 04:06:22 UTC

  flatpak (1.6.5-0ubuntu0.3) focal-security; urgency=medium

  * SECURITY UPDATE: Flatpak sandbox escape via crafted .desktop file
    (LP: #1918482)
   - debian/patches/CVE-2021-21381-1.patch: Disallow @@ and @@u usage in
     desktop files.
   - debian/patches/CVE-2021-21381-2.patch: dir: Reserve the whole @@
     prefix.
   - debian/patches/CVE-2021-21381-3.patch: dir: Refuse to export
     .desktop files with suspicious uses.
   - CVE-2021-21381

 -- Andrew Hayzen <email address hidden> Fri, 05 Mar 2021 22:21:25 +0000

Source diff to previous version
1918482 Update for CVE-2021-21381
CVE-2021-21381 Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before versi

Version: 1.6.5-0ubuntu0.2 2021-02-02 16:06:25 UTC

  flatpak (1.6.5-0ubuntu0.2) focal-security; urgency=medium

  * SECURITY UPDATE: Flatpak sandbox escape via spawn portal (LP: #1911473)
    - debian/patches/CVE-2021-21261-1.patch: tests: Add minimal version
      of "ok" helper.
    - debian/patches/CVE-2021-21261-2.patch: common: Add a backport of
      G_DBUS_METHOD_INVOCATION_HANDLED.
    - debian/patches/CVE-2021-21261-3.patch: run: Convert all environment
      variables into bwrap arguments.
    - debian/patches/CVE-2021-21261-4.patch: tests: Expand coverage for
      environment variable overrides.
    - debian/patches/CVE-2021-21261-5.patch: context: Add --env-fd option.
    - debian/patches/CVE-2021-21261-6.patch: portal: Convert --env in
      extra-args into --env-fd.
    - debian/patches/CVE-2021-21261-7.patch: tests: Exercise --env-fd.
    - debian/patches/CVE-2021-21261-8.patch: portal: Do not use
      caller-supplied variables in environment.
    - debian/patches/CVE-2021-21261-9.patch: tests: Assert that --env= does
      not go in `flatpak run` or bwrap environ.
    - CVE-2021-21261

 -- Andrew Hayzen <email address hidden> Wed, 13 Jan 2021 21:09:15 +0000

1911473 Update for ghsa-4ppf-fxf6-vxg2
CVE-2021-21261 Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug was discovered in the `flatpak-portal` ser



About   -   Send Feedback to @ubuntu_updates