Ubuntu alert USN-8288-1 (bubblewrap)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8288-1] Bubblewrap vulnerability
Date:
             
 
Thu, 21 May 2026 15:14:08 +0000
Message-ID:
             
 
<E1wQ568-0003um-Ay@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8288-1
May 20, 2026

bubblewrap vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10

Summary:

Bubblewrap could be made to bypass sandbox restrictions.

Software Description:
- bubblewrap: Low-level unprivileged sandboxing tool used by Flatpak and similar projects

Details:

It was discovered that Bubblewrap incorrectly handled the sandbox
setup phase when installed in setuid mode. A local attacker could
possibly use this issue to bypass sandbox restrictions.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  bubblewrap                      0.11.1-1ubuntu0.1

Ubuntu 25.10
  bubblewrap                      0.11.0-2ubuntu0.1

In general, a standard system update will make all the necessary
changes.

References:
  https://ubuntu.com/security/notices/USN-8288-1
  CVE-2026-41163

Package Information:
  https://launchpad.net/ubuntu/+source/bubblewrap/0.11.1-1u...
  https://launchpad.net/ubuntu/+source/bubblewrap/0.11.0-2u...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmoPIKYACgkQcpJm3tlz
hgEDOBAA1gxx4JpiVKaIcbcWSCFajMQxAy/sQnnB1UuVBthM6llTh0+FwNl9m7by
4XpqWFuCiGTgbfv/BW3UL0f47fw7QfP6HT2Gxmrro2c7HRgim7hxJxadWah6xr29
T6lUaJGb5RUwQHS3IoeYp1BTCkMPhMQ8PvMyOTHcnaFvYD0ay502kUS7xbl10GgU
QvRDZVPF/C4hbgOc7PERs39P/RLmAJ+QmA37p/7z649mUbr/tJabRU2CeouWSB5W
L7QKU634IWKAYl6d88fYflb8M+ZJhIvSM6lANSt18soXZ1qYgkSV3iz3lS9puvN1
VnAIucoEIRrIpEVULPfQcmKmI7A0PGrzr9s5TgqBg1z3ci+l3bf2gJnJARAeHQss
0ROajr8cZU78GMSMbniTNGVrZsMhctvSlIFr+uhROKWRpo2np2nvIKGDUxh6T/It
+fCxNMJKpEO9hSJgyFL2GUmhjnJK+A5yRubwCluczoJresun0CCBVJ+3PkztBcpP
gDim8TTvKcKKUeirK9bImbt0GLN5gi5b9tYF7nWOHxTJ2GPHtiNU/toJ617sp/Oh
LE9GFoIwa8fwjdGxw7XOX52WNAbXn75+Ti/mGCJ+XPTT3Ir9cEeq8x5UTRwjdHCJ
FulC/UGywExTIgFryeOS+qwGyRjvcHvkw9BKcD7V5POf2posxZ4=
=Amx6
-----END PGP SIGNATURE-----