-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 17 Apr 2024 19:43:12 +0100 Source: flatpak Binary: flatpak flatpak-dbgsym flatpak-tests flatpak-tests-dbgsym gir1.2-flatpak-1.0 libflatpak-dev libflatpak0 libflatpak0-dbgsym Architecture: armel Version: 1.10.8-0+deb11u2 Distribution: bullseye-security Urgency: high Maintainer: arm Build Daemon (arm-conova-02) Changed-By: Simon McVittie Description: flatpak - Application deployment framework for desktop apps flatpak-tests - Application deployment framework for desktop apps (tests) gir1.2-flatpak-1.0 - Application deployment framework for desktop apps (introspection) libflatpak-dev - Application deployment framework for desktop apps (development) libflatpak0 - Application deployment framework for desktop apps (library) Changes: flatpak (1.10.8-0+deb11u2) bullseye-security; urgency=high . * d/p/When-starting-non-static-command-using-bwrap-use.patch, d/p/test-run-Add-a-reproducer-for-CVE-2024-32462.patch: Don't allow an executable name to be misinterpreted as a command-line option for bwrap(1). This prevents a sandbox escape where a malicious or compromised app could ask xdg-desktop-portal to generate a .desktop file with access to files outside the sandbox. (CVE-2024-32462) Checksums-Sha1: 10b3a5e435c1edaf07adf9f017ad7c45b01b4798 5773860 flatpak-dbgsym_1.10.8-0+deb11u2_armel.deb f5df3e959e246aec4df6b6a79c6e5a70d5c8b76d 6471888 flatpak-tests-dbgsym_1.10.8-0+deb11u2_armel.deb 251e448340c5c63803b80c8d7f4733969a224a15 769608 flatpak-tests_1.10.8-0+deb11u2_armel.deb 87e5e16841fe91521b41ca597e8b646fafc0b0ee 14616 flatpak_1.10.8-0+deb11u2_armel-buildd.buildinfo ef39e451d2a8580ec7d3bda73ef92eea67134131 1140492 flatpak_1.10.8-0+deb11u2_armel.deb 5314ee8ea7135090fb2a10c82247cfb91f541328 37692 gir1.2-flatpak-1.0_1.10.8-0+deb11u2_armel.deb 7b85d4c510454faa9545bfb1c6a892c5e8be6f64 79556 libflatpak-dev_1.10.8-0+deb11u2_armel.deb 727f1df918d73dec523543a1d2ab9548c701351b 1372016 libflatpak0-dbgsym_1.10.8-0+deb11u2_armel.deb 894e2efeda4b5fcb0914828604b227e08fe96eab 300032 libflatpak0_1.10.8-0+deb11u2_armel.deb Checksums-Sha256: dc84b5ec846ff5eb6ad770d0f33bf3d443329060ff2899fdbb0f02538ed483a6 5773860 flatpak-dbgsym_1.10.8-0+deb11u2_armel.deb 32dea9c459c78d4076c27cd32cce5e84079d63fdcfd895a11f48a7c14e146069 6471888 flatpak-tests-dbgsym_1.10.8-0+deb11u2_armel.deb 84aa3646405533cbb845e58bfe06e8fdbed70befe8a084590e654c75396e9f2e 769608 flatpak-tests_1.10.8-0+deb11u2_armel.deb cdc4ead430c3013f12546a17e194c89d1fd3082f1d66fb900ab587a4a0daa310 14616 flatpak_1.10.8-0+deb11u2_armel-buildd.buildinfo e082509f3207bfd83dad142b47194f19baf99caf2197c0ae0fa13f2191d2b1b1 1140492 flatpak_1.10.8-0+deb11u2_armel.deb 5b2b0c0a04e01a78c0d556637a0d3b9e32709eefd95b220a45525635a4c9d373 37692 gir1.2-flatpak-1.0_1.10.8-0+deb11u2_armel.deb c2a5cc7fff8eb1c75ea5020e8e973767e7cc5d96474e4970ec79ac514c722cfa 79556 libflatpak-dev_1.10.8-0+deb11u2_armel.deb 5245df70a94a97e6e7e2b8eddae6995c879f806c6952d38590a1fd9466a48197 1372016 libflatpak0-dbgsym_1.10.8-0+deb11u2_armel.deb 12e17373343e1011090f3be38e1457fbf7c52a6e7a65f600fce5bc37ad967c15 300032 libflatpak0_1.10.8-0+deb11u2_armel.deb Files: d1964eed73bcb0c301e45fb9a1cadafc 5773860 debug optional flatpak-dbgsym_1.10.8-0+deb11u2_armel.deb 8ba56a2eb60ce06ab65ef0419e7b32ac 6471888 debug optional flatpak-tests-dbgsym_1.10.8-0+deb11u2_armel.deb aed96e8adb9d2178e899a5c9f65e1947 769608 misc optional flatpak-tests_1.10.8-0+deb11u2_armel.deb ff30d17e77d26affcb4992c120f23ada 14616 admin optional flatpak_1.10.8-0+deb11u2_armel-buildd.buildinfo e116ab7c0afa549b48b47323882ea56f 1140492 admin optional flatpak_1.10.8-0+deb11u2_armel.deb 06f389fab54ab0dc7e2b3d469d72ae7e 37692 introspection optional gir1.2-flatpak-1.0_1.10.8-0+deb11u2_armel.deb fc99c4e6466cfc4442fbff8165d20420 79556 libdevel optional libflatpak-dev_1.10.8-0+deb11u2_armel.deb aaeebc9bb56d68103fac54fdaf772bab 1372016 debug optional libflatpak0-dbgsym_1.10.8-0+deb11u2_armel.deb 0bb86dbf0da93631e859b902b2eb5770 300032 libs optional libflatpak0_1.10.8-0+deb11u2_armel.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEBv+o19JDIRm4yIQ5CeROIpkCGwcFAmYhcikACgkQCeROIpkC Gwd/YQ//ZGKU+y/DTpf1HOopL7DZTdGnws8B2qOnZ0UDDCNbqy7667ineEQYCS8U geAikKIvZ/Y2cNyuRjUq9yKWNBbO7xdcjlX3ZJ7vHvnoG+7thTiTsEHEgUwB6hAI 9qZnE7y6nxJHPrJcg61Kup1TV0Uxnb6uMejj+I/2xtP5O4pwwuTP3F4VJYW0MTel TWCcsEYrlLKr0dwNwJ4FIe5glEKItu7JDrbtuys8cAqNZEqYq0I5KRZOI+lAlx9w 5/0aZvtUmwhF3b8kHsuZldcpsQbLgMwch6ZZ4SZUdDkvXsmAun7cIz/2hvrU+PGi xYmYUaEg6st7bfW9k1W/zSXatTVi1i3BbcPGH+Kmy603GKEiwv79f5XdsbB+s5SU rBCgK/LIFGjcu6rfF9Yu472ioAaZzxXwMeIkNg/4NgL4XkBvbIXzpEyMNFr/W7qx gjxZfvNkRCd8kex++n26KVQsLnWbZ3DJ7C6V9XIgjJs4QHJyGqNUXPE19MSk83yC UudLUSAZd31JHBapljzNd1ClCG3LWD+R5T/iZNibv1sUoQCwfkCwusyJeqFOK2bc j4rIRIr5KVpBcrh+gtjreJSz/ptHJgyAvZBBf6KVkBD4IKhhF2pRrCxlFTiCpDIQ BBE58IwHb43yRhCKwLkwK8lzDDkWZXVX4qtxVZt4tzAJmG+D/mM= =pZxH -----END PGP SIGNATURE-----