Gentoo FoundationGLSA-202406-02Flatpak: Sandbox Escape
8.4 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
7.7 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
13.1%
Background
Flatpak is a Linux application sandboxing and distribution framework.
Description
A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details.
Impact
A malicious or compromised Flatpak app could execute arbitrary code outside its sandbox in conjunction with xdg-desktop-portal.
Workaround
There is no known workaround at this time.
Resolution
All Flatpak users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.14.6"
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Gentoo | any | all | sys-apps/flatpak | < 1.14.6 | UNKNOWN |
Related
8.4 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
7.7 High
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
13.1%