Latest security news

It should be several Packages that got updated. Did You checked the installed Versions? With apt list flatpak and apt list bubblewrap You should see that these are the current Versions.

When added the PPA and You make a sudo apt update && sudo apt upgrade, You should directly get the Updates.

1 Like

Thanks for the Link, it shows very actual security infos!

2 Likes
flatpak --version
Flatpak 1.18.4

:blush:


1 Like

Just updated. :+1:

Wish I had noticed and done this sooner, usually I'm on top of things but this one I greatly overlooked.

flatpak version says 1.14.10 so I tried the flatpak 1.18.4 command and it just said 1.18.4 is not a flatpak command. also tried flatpak update which updated a few apps that were from flatpak (I don't use flatpak unless absolutely necessary) and update flatpak wasan error too.

What is the command to update to 1.18.4??

1 Like

This command adds the PPA to your sources

sudo add-apt-repository ppa:flatpak/stable

This command updates the system

sudo apt update

Once completed, now check your flatpak version...

flatpak --version

1 Like

There is the sudo apt upgrade missing.

1 Like

It was me who posted originally, not Sapien. :wink:

He posted on August 14

:thinking:

I used his exact installation instructions and easily upgraded. @Ponce-De-Leon mentioned the upgrade command but the install code in that post has no upgrade command?

1 Like

Because @SAPien wrote:

which leads to the Installation of the newer flatpak Version. And it should update the related Packages, too.

When You would do after adding the PPA a sudo apt update && sudo apt upgrade the newer Versions would be detected, too and get updated.

At the end: Several Ways lead to the same Result.

2 Likes

That's what ran through my mind after posting. :smiling_face_with_sunglasses:

Thank you for the explanation. :+1:

1 Like

In view of the recent Flatpak security issue of breaking out into the system I decided to search for instances of A.I. use in any Flatpak.

I found an interesting article on FOSS LINUX. The article is very good and gives an in-depth look at Flatpak and comparisons with Snap and AppImage packaging. I will give the link at the end, but here are some highlights from it, starting with A.I. Policy:

" Why It Matters: Flathub’s AI policy is not just about code quality. It is about trust. When a user installs an app from Flathub, they are trusting that a real person reviewed the permissions, tested the sandboxing, and will respond to security issues. AI-generated apps skip all of that accountability."

Followed by [emphasis by me in Bold]

"There are exceptions for mature, well-maintained projects."

Interesting facts on validation [I have used Bold emphasis on an interesting point on the numbers]:

"## Evaluating App Quality on Flathub

Not every app on Flathub is created equal. With 3,542 apps, you need to know how to separate quality from noise. I look at three things before installing anything.

First, check for the Verified badge. Verified apps are published by the original developers and have been confirmed by the Flathub team. There are currently 2,092 verified apps out of 3,542 total. If an app is verified, you know the developer is actively maintaining it."

There is also mention of third party repositories, but if there are such third party repositories for unique Flatpak apps, how can verification be maintained and how do we know if there has been any bad actor involvement like occurred with xz?

Whilst a couple of CVE's have been rectified, one historic one in particular made me glad I never touched Flatpak:

"CVE-2026-34079 prevented arbitrary file deletion."

Whilst some small praise was given to Canonical's Snap it was balanced by stating it's drawbacks [which I have emphasised in Bold] and let's not forget Canonical's implementation of A.I. in Ubuntu 26.04:

" Snap wins on Ubuntu integration. If you are running Ubuntu, Snaps work seamlessly out of the box. The snapd daemon handles updates automatically, and the Ubuntu Software Center surfaces Snaps prominently. The downside is the canonical-controlled store and the daemon overhead that runs in the background."

Read the full article here including useful tips if you are still keen to use it, but not in my daily OS :wink:.

https://www.fosslinux.com/157752/flathub-flatpak-complete-guide.htm

[Side note: On the comment on AppImage:

" AppImage wins on simplicity. Download one file, make it executable, run it. No daemon, no repository, no sandbox. The trade-off is no automatic updates and no centralized discovery. AppImages are great for portable tools but do not scale well for a desktop app ecosystem."

There are instances in an Education setting where AppImages are essential in respect of portableapps from portableapps.com. I recently gave advice to someone whose student's needed NVDA, and similarly Inkscape in situations where schools won't agree to install anything outside the MS ecosystem. I was fortunate to work in an IR of a school where the IT Department agreed for us to use Inkscape which saved the service wasting £200 per machine licence on Accessible Drawing Software that was not needed. Just pity the students with a visual impairment who attend schools running Google Classrooms who don't have access to MS Office, as Google Docs is nowhere near as accessible visually when it comes to applying Styles!]

I updated and upgraded, but it took it no further than version 1.16.6. ...because I'm on Z16.

Then perhaps it is time to move to Zorin 17 at least?

Zorin 16 was based on Ubuntu 20.04, and the Flatpak versions have two CVE issues stated in that FOSS LINUX article I posted. Or just remove Flatpak and hope for the best.

Yes, you've run into the one negative con with staying on Zorin OS 16, lack of new software support. Its not the end of the world though. Unless you really need the latest version, you'll do fine.


1 Like

I wouldn't say new software, rather, how secure do you want your system. :wink:

1 Like

Wow, what a blast from the past! I haven't even thought about PortableApps.com in, gosh, well over a decade! I'm slightly surprised it's still going strong, last update released just a month ago, but pleasantly so. I might have to dig out a spare USB stick and set it up with some again for old times' sake.

2 Likes

Scammers are getting smarter about where they target you  | Malwarebytes?