UbuntuUpdates.org

Package "bubblewrap"

Name: bubblewrap

Description:

utility for unprivileged chroot and namespace manipulation
Latest version: 0.9.0-1ubuntu0.3
Release: noble (24.04)
Level: security
Repository: main
Homepage: https://github.com/containers/bubblewrap

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "bubblewrap"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "bubblewrap" in Noble

Repository Area Version
base main 0.9.0-1build1
updates main 0.9.0-1ubuntu0.3

Changelog

Version: 0.9.0-1ubuntu0.3 2026-09-18 00:07:44 UTC

bubblewrap (0.9.0-1ubuntu0.3) noble-security; urgency=medium

  * SECURITY REGRESSION: Incompatibility with Flatpak (LP: #2167621)
    - debian: Drop CVE-2026-87766

 -- Kyle Kernick Thu, 17 Sep 2026 14:12:52 -0600
Source diff to previous version
2167621 bubblewrap 0.11.1-1ubuntu0.2 breaks Flatpak applications with bind mount / symlink resolution errors
CVE-2026-87766 A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via

Version: 0.9.0-1ubuntu0.2 2026-09-17 17:07:39 UTC

bubblewrap (0.9.0-1ubuntu0.2) noble-security; urgency=medium

  * SECURITY UPDATE: Improper link resolution during sandbox setup
    - debian/patches/CVE-2026-87766-1.patch: Import safe_openat() from crun
      in chroot_realpath.c, meson.build, safe_openat.c, and utils.h
    - debian/patches/CVE-2026-87766-2.patch: Create and resolve destinations
      without following symlinks, and reject mount operations on symlink
      destinations in bubblewrap.c
    - CVE-2026-87766

 -- Kyle Kernick Mon, 14 Sep 2026 12:44:27 -0600
Source diff to previous version
CVE-2026-87766 A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via

Version: 0.9.0-1ubuntu0.1 2024-09-30 19:06:57 UTC

  bubblewrap (0.9.0-1ubuntu0.1) noble-security; urgency=medium

   * This is expected to be included in 0.10.0, and is necessary to resolve
     CVE-2024-42472 in Flatpak without introducing a potentially exploitable
     race condition.

 -- Leonidas Da Silva Barbosa <email address hidden> Mon, 23 Sep 2024 15:15:56 -0300
CVE-2024-42472 Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app us


About   -   Send Feedback to @ubuntu_updates