Flatpak 1.19 Released With Nine Security Fixes

Flatpak 1.19 was released today as a new development release along with the Flatpak 1.18.1 stable point release. Both of these releases ship a number of newly-discovered security issues with this app sandboxing and distribution tech. There are nine security fixes to Flatpak 1.19 and ten for Flatpak 1.18.1. These security fixes include a a possible sandbox escape with full host file-system read/write access via a symlink attack. There is also a local root privilege escalation vulnerability via revokefs symlink path traversal. There are also multiple arbitrary root read/writes, a possible buffer overflow on 32-bit systems, and other security issues resolved. Flatpak 1.19 on the feature side now allows system-wide downgrades through the system helper, improved Bash completion, and other enhancements and fixes. The full list of Flatpak 1.19 changes can be found via GitHub. See the 1.18.1 tag for all of the security and bug fixes there.