Lucene search

K
mageiaGentoo FoundationMGASA-2023-0115
HistoryMar 24, 2023 - 8:55 a.m.

Updated flatpak packages fix security vulnerability

2023-03-2408:55:49
Gentoo Foundation
advisories.mageia.org
20

0.008 Low

EPSS

Percentile

81.5%

If a malicious Flatpak app is run on a Linux virtual console such as /dev/tty1, it can copy text from the virtual console and paste it back into the virtual console’s input buffer, from which the command might be run by the user’s shell after the Flatpak app has exited. This is similar to CVE-2017-5226, but using the TIOCLINUX ioctl command instead of TIOCSTI. (CVE-2023-28100) Flatpak app with elevated permissions mayhide those permissions from users of the ‘flatpak(1)’ command-line interface by setting other permissions to crafted values that contain non-printable control characters such as ‘ESC’. (CVE-2023-28101)

OSVersionArchitecturePackageVersionFilename
Mageia8noarchflatpak< 1.12.8-1flatpak-1.12.8-1.mga8