UbuntuUpdates.org

Package "bubblewrap"

Name: bubblewrap

Description:

utility for unprivileged chroot and namespace manipulation
Latest version: 0.11.1-1ubuntu0.3
Release: resolute (26.04)
Level: security
Repository: main
Homepage: https://github.com/containers/bubblewrap

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "bubblewrap"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "bubblewrap" in Resolute

Repository Area Version
base main 0.11.1-1
updates main 0.11.1-1ubuntu0.3

Changelog

Version: 0.11.1-1ubuntu0.3 2026-09-18 00:07:49 UTC

bubblewrap (0.11.1-1ubuntu0.3) resolute-security; urgency=medium

  * SECURITY REGRESSION: Incompatibility with Flatpak (LP: #2167621)
    - debian: Drop CVE-2026-87766

 -- Kyle Kernick Thu, 17 Sep 2026 14:12:13 -0600
Source diff to previous version
2167621 bubblewrap 0.11.1-1ubuntu0.2 breaks Flatpak applications with bind mount / symlink resolution errors
CVE-2026-87766 A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via

Version: 0.11.1-1ubuntu0.2 2026-09-17 17:07:42 UTC

bubblewrap (0.11.1-1ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Improper link resolution during sandbox setup
    - debian/patches/CVE-2026-87766-1.patch: Import safe_openat() from crun
      in chroot_realpath.c, meson.build, safe_openat.c, and utils.h
    - debian/patches/CVE-2026-87766-2.patch: Create and resolve destinations
      without following symlinks, and reject mount operations on symlink
      destinations in bubblewrap.c
    - CVE-2026-87766

 -- Kyle Kernick Mon, 14 Sep 2026 12:42:51 -0600
Source diff to previous version
CVE-2026-87766 A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via

Version: 0.11.1-1ubuntu0.1 2026-05-20 19:07:25 UTC

  bubblewrap (0.11.1-1ubuntu0.1) resolute-security; urgency=medium

  * SECURITY UPDATE: Privilege escalation via ptrace.
    - debian/patches/CVE-2026-41163.patch: Disallow ptrace while running
      privileged code in bubblewrap.c
    - CVE-2026-41163

 -- Kyle Kernick <email address hidden> Tue, 28 Apr 2026 14:17:30 -0600
CVE-2026-41163 bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then


About   -   Send Feedback to @ubuntu_updates