An update for flatpak is now available for openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3852 Final 1.0 1.0 2026-09-14 Initial 2026-09-14 2026-09-14 openEuler SA Tool V1.0 2026-09-14 flatpak security update An update for flatpak is now available for openEuler-20.03-LTS-SP4 flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fix(es): A vulnerability, which was classified as very critical, has been found in Flatpak up to 1.10.7/1.12.7/1.14.3/1.15.3.Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Impacted is confidentiality, integrity, and availability.Upgrading to version 1.10.8, 1.12.8, 1.14.4 or 1.15.4 eliminates this vulnerability.(CVE-2023-28100) An update for flatpak is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP3/openEuler-24.03-LTS/openEuler-24.03-LTS-Next. openEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. Critical flatpak https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3852 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2023-28100 https://nvd.nist.gov/vuln/detail/CVE-2023-28100 openEuler-20.03-LTS-SP4 flatpak-help-1.0.3-15.oe2003sp4.noarch.rpm flatpak-1.0.3-15.oe2003sp4.aarch64.rpm flatpak-debuginfo-1.0.3-15.oe2003sp4.aarch64.rpm flatpak-debugsource-1.0.3-15.oe2003sp4.aarch64.rpm flatpak-devel-1.0.3-15.oe2003sp4.aarch64.rpm flatpak-1.0.3-15.oe2003sp4.src.rpm flatpak-1.0.3-15.oe2003sp4.x86_64.rpm flatpak-debuginfo-1.0.3-15.oe2003sp4.x86_64.rpm flatpak-debugsource-1.0.3-15.oe2003sp4.x86_64.rpm flatpak-devel-1.0.3-15.oe2003sp4.x86_64.rpm A vulnerability, which was classified as very critical, has been found in Flatpak up to 1.10.7/1.12.7/1.14.3/1.15.3.Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Impacted is confidentiality, integrity, and availability.Upgrading to version 1.10.8, 1.12.8, 1.14.4 or 1.15.4 eliminates this vulnerability. 2026-09-14 CVE-2023-28100 openEuler-20.03-LTS-SP4 Critical 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N flatpak security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3852