Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.
CVSS Details
- CVSS 3.1 Base Score: 10
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpak-session-helperUpgrade flatpak-develUpgrade flatpak-selinuxUpgrade flatpak-libsUpgrade flatpak | Nov 16, 2023 | Mar 16, 2023 |
| Amazon Linux Ami 2 | — | Upgrade flatpak-builderUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-libsUpgrade flatpak | Jul 21, 2023 | Mar 16, 2023 |
| Centos_linux | — | Upgrade flatpak-debuginfoUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-tests-debuginfoUpgrade flatpakUpgrade flatpak-debugsourceUpgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpak-libs-debuginfo | Nov 8, 2023 | Mar 16, 2023 |
| Debian | — | Upgrade flatpak | Jul 30, 2024 | Mar 16, 2023 |
| Gentoo Linux | — | Upgrade sys-apps/flatpak. | Dec 27, 2023 | Mar 16, 2023 |
| Oracle_linux | — | Upgrade flatpak-develUpgrade flatpak-libsUpgrade flatpak-session-helperUpgrade flatpakUpgrade flatpak-selinux | Nov 22, 2023 | Mar 16, 2023 |
| Redhat_linux | — | Upgrade flatpak-session-helperUpgrade flatpak-develUpgrade flatpak-debugsourceUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-libs-debuginfoUpgrade flatpak-tests-debuginfoUpgrade flatpak-libsUpgrade flatpak-selinuxUpgrade flatpak-debuginfoUpgrade flatpak | Nov 8, 2023 | Mar 16, 2023 |
| Rocky_linux | — | Upgrade flatpak-session-helperUpgrade flatpak-debuginfoUpgrade flatpak-libsUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-develUpgrade flatpak-libs-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak | May 13, 2024 | Mar 16, 2023 |
| Suse | — | Upgrade flatpak-remote-flathubUpgrade system-user-flatpakUpgrade flatpak-zsh-completionUpgrade flatpak-develUpgrade libflatpak0Upgrade flatpakUpgrade typelib-1_0-flatpak-1_0 | Apr 3, 2023 | Mar 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub