mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-04-06 16:15:21 -04:00
Code Issues Packages Projects Releases Wiki Activity

Update NEWS

Browse Source 
Signed-off-by: Simon McVittie <smcv@collabora.com>
This commit is contained in:
Simon McVittie
2023-03-15 17:35:26 +00:00
parent a9bf18040c
commit ee9c5a16f8
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
NEWS
View File

@@ -2,6 +2,20 @@ Changes in 1.10.8
~~~~~~~~~~~~~~~~~
Not released yet
Security fixes:
* Escape special characters when displaying permissions and metadata,
preventing malicious apps from manipulating the appearance of the
permissions list using crafted metadata (CVE-2023-28101).
* If a Flatpak app is run on a Linux virtual console (tty1, tty2, etc.),
don't allow copy/paste via the TIOCLINUX ioctl (CVE-2023-28100).
Note that this is specific to virtual consoles: Flatpak is not
vulnerable to this if run from a graphical terminal emulator such as
xterm, gnome-terminal or Konsole.
Other bug fixes:
* If an app update is blocked by parental controls policies, clean up the
temporary deploy directory (#5146)
* Fix Autotools build with versions of gpgme that no longer provide
@@ -16,6 +30,7 @@ Not released yet
* Fix a typo in an error message
* Fix incorrect year in NEWS for 1.10.7 release
* Translation update: pl
* Add test coverage for Flatpak's seccomp filters
Changes in 1.10.7
~~~~~~~~~~~~~~~~~