Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade flatpak-develUpgrade flatpak-libsUpgrade flatpakUpgrade flatpak-builderUpgrade flatpak-debuginfo | Apr 27, 2020 | Feb 12, 2019 |
| Centos_linux | — | Upgrade flatpakUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-builder | Feb 22, 2019 | Feb 12, 2019 |
| Debian | — | Upgrade flatpak | Feb 14, 2019 | Feb 14, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flatpak-libsUpgrade flatpak | Apr 3, 2019 | Feb 12, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade flatpakUpgrade flatpak-libs | Aug 31, 2020 | Feb 12, 2019 |
| Oracle_linux | — | Upgrade flatpak-develUpgrade flatpak-builderUpgrade flatpakUpgrade flatpak-libs | Jul 21, 2020 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-builderUpgrade flatpak | Feb 20, 2019 | Feb 12, 2019 |
| Suse | — | Upgrade flatpakUpgrade typelib-1_0-flatpak-1_0Upgrade libflatpak0Upgrade flatpak-devel | Sep 3, 2019 | Feb 12, 2019 |
| Ubuntu | — | Upgrade flatpak | Nov 19, 2024 | Feb 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub