UbuntuUpdates.org

Package "bubblewrap"

Name: bubblewrap

Description:

utility for unprivileged chroot and namespace manipulation
Latest version: 0.6.1-1ubuntu0.3
Release: jammy (22.04)
Level: updates
Repository: main
Homepage: https://github.com/containers/bubblewrap

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "bubblewrap"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "bubblewrap" in Jammy

Repository Area Version
base main 0.6.1-1
security main 0.6.1-1ubuntu0.3

Changelog

Version: 0.6.1-1ubuntu0.3 2026-09-18 04:07:30 UTC

bubblewrap (0.6.1-1ubuntu0.3) jammy-security; urgency=medium

  * SECURITY REGRESSION: Incompatibility with Flatpak (LP: #2167621)
    - debian: Drop CVE-2026-87766

 -- Kyle Kernick Thu, 17 Sep 2026 14:13:14 -0600
2167621 bubblewrap 0.11.1-1ubuntu0.2 breaks Flatpak applications with bind mount / symlink resolution errors
CVE-2026-87766 A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via

Version: *DELETED* 2026-09-18 00:07:42 UTC
No changelog for deleted or moved packages.

Version: 0.6.1-1ubuntu0.2 2026-09-17 22:07:48 UTC

bubblewrap (0.6.1-1ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Improper link resolution during sandbox setup
    - debian/patches/CVE-2026-87766-1.patch: Import safe_openat() from crun
      in chroot_realpath.c, meson.build, safe_openat.c, and utils.h
    - debian/patches/CVE-2026-87766-2.patch: Create and resolve destinations
      without following symlinks, and reject mount operations on symlink
      destinations in bubblewrap.c
    - CVE-2026-87766

 -- Kyle Kernick Mon, 14 Sep 2026 12:45:35 -0600
Source diff to previous version
CVE-2026-87766 A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via

Version: 0.6.1-1ubuntu0.1 2024-09-30 20:07:03 UTC

  bubblewrap (0.6.1-1ubuntu0.1) jammy-security; urgency=medium

   * This is expected to be included in 0.10.0, and is necessary to resolve
     CVE-2024-42472 in Flatpak without introducing a potentially exploitable
     race condition.

 -- Leonidas Da Silva Barbosa <email address hidden> Mon, 23 Sep 2024 12:52:33 -0300
CVE-2024-42472 Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app us


About   -   Send Feedback to @ubuntu_updates