flatpak flatpak vulnerabilities and exploits

(subscribe to this query)

6.8

CVSSv2

Flatpak prior to 1.0.8, 1.1.x and 1.2.x prior to 1.2.4, and 1.3.x prior to 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject c...

Flatpak Flatpak Flatpak Flatpak 1.3.0

NA

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions before 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app...

Flatpak Flatpak

NA

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions before 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak...

Flatpak Flatpak

7.2

CVSSv2

In Flatpak prior to 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable ...

Flatpak Flatpak Debian Debian Linux 9.0

7.2

CVSSv2

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. A bug exists in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is pres...

Flatpak Flatpak Debian Debian Linux 10.0

4

CVSSv2

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak before 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is ...

Flatpak Flatpak-builder Flatpak Flatpak Fedoraproject Fedora 35 Redhat Enterprise Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0

4.6

CVSSv2

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions before 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host...

Flatpak Flatpak Debian Debian Linux 11.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34

5.8

CVSSv2

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an malicious user to gain access to f...

Flatpak Flatpak Debian Debian Linux 10.0 Fedoraproject Fedora 33 Fedoraproject Fedora 34

6.8

CVSSv2

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in t...

Flatpak Flatpak Fedoraproject Fedora 35 Redhat Enterprise Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Debian Debian Linux 11.0

4.4

CVSSv2

Flatpak prior to 1.0.7, and 1.1.x and 1.2.x prior to 1.2.3, exposes /proc in the apply_extra script sandbox, which allows malicious users to modify a host-side executable file.

Flatpak Flatpak Debian Debian Linux 9.0 Debian Debian Linux 10.0 Redhat Enterprise Linux Desktop 7.0 Redhat Enterprise Linux Server Aus 7.6 Redhat Enterprise Linux Workstation 7.0 Redhat Enterprise Linux Server Tus 7.6 Redhat Enterprise Linux Server 7.0 Redhat Enterprise Linux Server Eus 7.6

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook