In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade flatpak-develUpgrade flatpak-libsUpgrade flatpak-builderUpgrade flatpak-debuginfoUpgrade flatpak | Apr 27, 2020 | Feb 2, 2018 |
| Centos_linux | — | Upgrade flatpak-develUpgrade flatpak-debuginfoUpgrade flatpak-builderUpgrade flatpakUpgrade flatpak-libs | Oct 2, 2018 | Feb 2, 2018 |
| Debian | — | Upgrade flatpak | Jul 30, 2024 | Feb 2, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flatpak-libsUpgrade flatpak | Nov 19, 2019 | Feb 2, 2018 |
| Oracle_linux | — | Upgrade flatpak-libsUpgrade flatpakUpgrade flatpak-develUpgrade flatpak-builder | Sep 26, 2018 | Jan 29, 2018 |
| Redhat_linux | — | Upgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-builderUpgrade flatpak | Sep 26, 2018 | Feb 2, 2018 |
| Suse | — | Upgrade typelib-1_0-flatpak-1_0Upgrade flatpak-builder-debuginfoUpgrade flatpak-develUpgrade flatpak-debugsourceUpgrade flatpak-debuginfoUpgrade libflatpak0Upgrade flatpak-builderUpgrade libflatpak0-debuginfoUpgrade flatpak | Feb 9, 2018 | Feb 2, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub