RHEL 7 : flatpak (RHSA-2018:2766)

An update for flatpak is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

Scientific Linux Security Update : flatpak on SL7.x x86_64 (20180925)

Security Fixes : - flatpak: sandbox escape in D-Bus filtering by a crafted authentication handshake CVE-2018-6560 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid117786; scriptversion"1.4";...

Oracle Linux 7 : flatpak (ELSA-2018-2766)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-2766 advisory. 0.8.8-4 - Add patch for CVE-2018-6560 1547376 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

flatpak security update

0.8.8-4 - Add patch for CVE-2018-6560 1547376...

MGASA-2018-0143 Updated flatpak packages fix security vulnerability

Updated flatpak packages fix security vulnerability: A sandbox escape in the flatpak dbus proxy in the authentication phase CVE-2018-6560. The flatpak has been upgraded to the latest stable version, 0.10.3, which fixes this issue. The bubblewrap, ostree, flatpak-builder, xdg-desktop-portal,...

Updated flatpak packages fix security vulnerability

Updated flatpak packages fix security vulnerability: A sandbox escape in the flatpak dbus proxy in the authentication phase CVE-2018-6560. The flatpak has been upgraded to the latest stable version, 0.10.3, which fixes this issue. The bubblewrap, ostree, flatpak-builder, xdg-desktop-portal,...

openSUSE Security Update : flatpak (openSUSE-2018-139)

This update for flatpak to version 0.8.9 fixes security issues and bugs. The following vulnerabilities were fixed : - CVE-2018-6560: sandbox escape in the flatpak dbus proxy boo1078923 - CVE-2017-9780: Malicious apps could have included inappropriate permissions boo1078989 - old-style eavesdroppi...

CVE-2018-6560

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon...

CVE-2018-6560

CVE-2018-6560 affects Flatpak’s D-Bus proxy (dbus-proxy/flatpak-proxy.c) in Flatpak versions prior to 0.8.9, and in 0.9.x and 0.10.x prior to 0.10.3. The issue is caused by whitespace handling in the proxy not matching the daemon, enabling crafted D‑Bus messages to escape the sandbox. Practical i...

CVE-2013-6560

CVE-2013-6560 entry is rejected and does not represent an active vulnerability.

CVE-2013-6560

...

CVE-2016-6560

The CVE-2016-6560 family affects illumos via osnet-incorporation: bcopy() and bzero() implementati ons use signed rather than unsigned comparisons, leading to a NULL-pointer dereference / system crash. The impact described across sources is a crash vulnerability (denial of service). The available...

CVE-2016-6560

illumos osnet-incorporation bcopy and bzero implementations make signed instead of unsigned comparisons allowing a system crash...

CVE-2017-6560

XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=misc&action=XSS&editObjId=XSS attack...

CVE-2017-6560

CVE-2017-6560 describes a cross-site scripting vulnerability in Agora-Project 3.2.2. The issue is triggered via an XSS payload in index.php?ctrl=misc&action=[XSS]&editObjId=[XSS], allowing injection into the application. The provided sources confirm the affected software and the vulnerability cla...

CVE-2014-6560

Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2014-6453,...

CVE-2014-6560

The CVE-2014-6560 entry describes an unspecified vulnerability in the Java VM component of Oracle Database Server versions 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2. It allows remote authenticated users to affect confidentiality, integrity, and availability, via unknown vectors, and is...

CVE-2014-6560

Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2014-6453,...

CVE-2012-6560

Summary: CVE-2012-6560 is a SQL injection in FreeNAC 3.02, specifically in deviceadd.php via the status parameter. The OpenVAS entry also notes additional vulnerabilities in FreeNAC (multiple XSS/HTML/SQL injection). The NVD/NVD-derived descriptions confirm the SQL injection flaw exists in FreeNA...

SuSE 10 Security Update : xpdf (ZYPP Patch Number 6560)

Specially crafted PDF files could cause buffer overflows in xpdf when viewing such a document. CVE-2009-3603 / CVE-2009-3604 / CVE-2009-3605 / CVE-2009-3606 / CVE-2009-3608 / CVE-2009-3609 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. i...