Swick

**Name of the Vulnerable Software and Affected Versions** Flatpak (affected versions not specified) **Description** A path traversal issue exists in the way the software handles the `export/bin` directory during app deployment. This allows a malicious application to trigger the deletion of arbitrary files located outside the deployment directory during installation or upgrade processes. In the case of system-wide installations, these deletions are executed with root privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Red Hat Enterprise Linux (affected versions not specified) **Description** The OCI delta stream parser reads sizes as `guint64` but passes them to GLib I/O and allocation functions that expect `gsize`. On 32-bit systems, `gsize` is 32 bits, which causes undersized memory allocations. Because subsequent operations continue to use the original 64-bit size, heap buffer overflows occur. An attacker controlling an OCI registry can craft a malicious delta stream to trigger this issue during a flatpak install or update, potentially leading to arbitrary code execution on 32-bit systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.