In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade flatpakUpgrade flatpak-builderUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-libs | Apr 27, 2020 | Feb 2, 2018 |
| Centos_linux | — | Upgrade flatpak-develUpgrade flatpakUpgrade flatpak-debuginfoUpgrade flatpak-libsUpgrade flatpak-builder | Oct 2, 2018 | Feb 2, 2018 |
| Debian | — | Upgrade flatpak | Jul 30, 2024 | Feb 2, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flatpakUpgrade flatpak-libs | Nov 19, 2019 | Feb 2, 2018 |
| Oracle_linux | — | Upgrade flatpak-develUpgrade flatpakUpgrade flatpak-libsUpgrade flatpak-builder | Sep 26, 2018 | Jan 29, 2018 |
| Redhat_linux | — | Upgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpakUpgrade flatpak-builder | Sep 26, 2018 | Feb 2, 2018 |
| Suse | — | Upgrade flatpak-debugsourceUpgrade flatpak-builder-debuginfoUpgrade flatpak-develUpgrade typelib-1_0-flatpak-1_0Upgrade libflatpak0-debuginfoUpgrade flatpak-debuginfoUpgrade flatpak-builderUpgrade flatpakUpgrade libflatpak0 | Feb 9, 2018 | Feb 2, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub