News: 0001625480

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Flatpak 1.16.4 Brings Important Security Fixes For Sandbox Escape & Deleting Host Files

([Free Software] 14 Minutes Ago Flatpak 1.16.4)


That Flatbox app sandboxing and distribution system is out today with important security updates.

First up with Flatpak 1.16.4 is a fix for CVE-2026-34078, which is a security issue allowing a complete sandbox escape leading to host file access and code execution in the host context. Ouch. The issue is due to Flatpak portal accepting paths in the sandbox-expose options that can be app-controlled symlinks pointing at arbitrary paths. Due to this apps can access all host files and can be used as a primitive for gaining code execution in the host context. Disabling Flatpak Portal is another way to workaround this issue but can cause app problems.

CVE-2026-34079 is also fixed and is for preventing arbitrary file deletion on the host file-system. CVE-2026-34079 stems from caching for ld.so removing outdated cache files without checking that the app controlled path to the outdated cache is in the cache directory.

GHSA-2fxp-43j9-pwvc is another security issue fixed for preventing arbitrary read-access to files in the system-helper context. Lastly there is a fix for preventing orphaning cross-user pull operations.

Flatpak 1.16.4 downloads and more details on the new release via [1]GitHub .



[1] https://github.com/flatpak/flatpak/releases/tag/1.16.4


Throwing Windows Out The Window

The Federal Bureau Of Missing Socks has banned the use of Microsoft Windows
and Office on all employee computers. But don't get too excited; they aren't
going to replace them with Linux. Instead, this government agency has decided
to go back to using abucusses, slide rules, and manual typewriters.

The banishment of Microsoft software stems from the agency's new policy
against computer games. MS Office, which contains several games in the form of
Easter Eggs, is now verboten on all agency computers. "Flight simulators,
pinball games, magic eight balls... they all violate our policy," said the
sub-adjunct administrator second-class. "So we can't use Office."

Windows is forbidden for the same reason. "We've had way too many
employees wasting time playing Solitaire," she said. "Unfortunately,
Solitaire is an integral part of Windows -- Microsoft executives said so
during the anti-trust trial. If Solitaire is removed, the operating system
won't function properly. Therefore, we have no choice but to banish all
Windows computers."

The Bureau's Assistant Technology Consultant, Mr. Reginald "Red" Taype,
asked, "Have you ever seen an abucus crash? Have you ever seen anybody
have fun with a slide rule? Do adding machines contain undocumented easter
eggs? No! That's why we're ditching our PCs."