Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.
CVSS Details
- CVSS 3.1 Base Score: 8.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade flatpakUpgrade flatpak-libsUpgrade flatpak-builderUpgrade flatpak-debuginfoUpgrade flatpak-devel | Apr 27, 2020 | Feb 12, 2019 |
| Centos_linux | — | Upgrade flatpak-builderUpgrade flatpak-develUpgrade flatpak-libsUpgrade flatpakUpgrade flatpak-debuginfo | Feb 22, 2019 | Feb 12, 2019 |
| Debian | — | Upgrade flatpak | Feb 14, 2019 | Feb 14, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade flatpakUpgrade flatpak-libs | Apr 3, 2019 | Feb 12, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade flatpak-libsUpgrade flatpak | Aug 31, 2020 | Feb 12, 2019 |
| Oracle_linux | — | Upgrade flatpak-develUpgrade flatpak-builderUpgrade flatpakUpgrade flatpak-libs | Jul 21, 2020 | Feb 11, 2019 |
| Redhat_linux | — | Upgrade flatpakUpgrade flatpak-builderUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-devel | Feb 20, 2019 | Feb 12, 2019 |
| Suse | — | Upgrade flatpak-develUpgrade flatpakUpgrade typelib-1_0-flatpak-1_0Upgrade libflatpak0 | Sep 3, 2019 | Feb 12, 2019 |
| Ubuntu | — | Upgrade flatpak | Nov 19, 2024 | Feb 12, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub