Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade flatpak-develUpgrade flatpak-session-helperUpgrade flatpak-libsUpgrade flatpakUpgrade flatpak-selinux | Nov 16, 2023 | Mar 16, 2023 |
| Centos_linux | — | Upgrade flatpak-libs-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-selinuxUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-session-helperUpgrade flatpakUpgrade flatpak-libsUpgrade flatpak-tests-debuginfoUpgrade flatpak-debuginfo | Nov 8, 2023 | Mar 16, 2023 |
| Debian | — | Upgrade flatpak | Jul 30, 2024 | Mar 16, 2023 |
| Gentoo Linux | — | Upgrade sys-apps/flatpak. | Dec 27, 2023 | Mar 16, 2023 |
| Oracle_linux | — | Upgrade flatpak-develUpgrade flatpak-session-helperUpgrade flatpak-libsUpgrade flatpak-selinuxUpgrade flatpak | Nov 22, 2023 | Mar 16, 2023 |
| Redhat_linux | — | Upgrade flatpakUpgrade flatpak-libs-debuginfoUpgrade flatpak-tests-debuginfoUpgrade flatpak-debugsourceUpgrade flatpak-session-helperUpgrade flatpak-libsUpgrade flatpak-debuginfoUpgrade flatpak-selinuxUpgrade flatpak-develUpgrade flatpak-session-helper-debuginfo | Nov 8, 2023 | Mar 16, 2023 |
| Rocky_linux | — | Upgrade flatpakUpgrade flatpak-libs-debuginfoUpgrade flatpak-session-helperUpgrade flatpak-debugsourceUpgrade flatpak-debuginfoUpgrade flatpak-develUpgrade flatpak-session-helper-debuginfoUpgrade flatpak-libs | May 13, 2024 | Mar 16, 2023 |
| Suse | — | Upgrade flatpak-develUpgrade flatpak-remote-flathubUpgrade system-user-flatpakUpgrade flatpakUpgrade typelib-1_0-flatpak-1_0Upgrade libflatpak0Upgrade flatpak-zsh-completion | Apr 3, 2023 | Mar 16, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub