Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpak-libsUpgrade flatpakUpgrade flatpak-session-helperUpgrade flatpak-selinuxUpgrade flatpak-devel | Nov 16, 2023 | Mar 16, 2023 |
| Centos_linux | — | Upgrade flatpak-libs-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-selinuxUpgrade flatpak-session-helperUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-tests-debuginfoUpgrade flatpak | Nov 8, 2023 | Mar 16, 2023 |
| Debian | — | Upgrade flatpak | Jul 30, 2024 | Mar 16, 2023 |
| Gentoo Linux | — | Upgrade sys-apps/flatpak. | Dec 27, 2023 | Mar 16, 2023 |
| Oracle_linux | — | Upgrade flatpak-develUpgrade flatpak-session-helperUpgrade flatpakUpgrade flatpak-libsUpgrade flatpak-selinux | Nov 22, 2023 | Mar 16, 2023 |
| Redhat_linux | — | Upgrade flatpak-session-helper-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-libsUpgrade flatpak-selinuxUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpakUpgrade flatpak-tests-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-libs-debuginfo | Nov 8, 2023 | Mar 16, 2023 |
| Rocky_linux | — | Upgrade flatpak-session-helper-debuginfoUpgrade flatpak-develUpgrade flatpak-libs-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-session-helperUpgrade flatpak | May 13, 2024 | Mar 16, 2023 |
| Suse | — | Upgrade system-user-flatpakUpgrade flatpakUpgrade flatpak-zsh-completionUpgrade libflatpak0Upgrade typelib-1_0-flatpak-1_0Upgrade flatpak-develUpgrade flatpak-remote-flathub | Apr 3, 2023 | Mar 16, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub