Amazon Linux 2 : flatpak (ALAS-2019-1219)

Flatpak allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox...

Important: flatpak

Issue Overview: Flatpak allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outsi...

Authentication Bypass

Flatpak is vulnerable to authentication bypass. Remote unauthenticated attackers could bypass the authentication mechanism via an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would tre...

Oracle Linux 7 : flatpak (ELSA-2019-1024)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1024 advisory. 1.0.2-5 - Fix IOCSTI sandbox bypass 1700651 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

CentOS 7 : flatpak (CESA-2019:1024)

An update for flatpak is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CentOS Update for flatpak CESA-2019:1024 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

flatpak security update

CentOS Errata and Security Advisory CESA-2019:1024 An update for flatpak is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)

An incomplete fix for CVE-2017-5226 was found in flatpak. A sandbox bypass flaw was found in the way bubblewrap, which is used for sandboxing flatpak applications handled the TIOCSTI ioctl. A malicious flatpak application could use this flaw to inject commands into the controlled terminal of the...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 8 : flatpak (RHSA-2019:1143)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1143 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Sandbox bypass via IOCS...

Scientific Linux Security Update : flatpak on SL7.x x86_64 (20190508)

Security Fixes : - flatpak: Sandbox bypass via IOCSTI incomplete fix for CVE-2017-5226 CVE-2019-10063 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid124705; scriptversion"1.4";...

RHEL 7 : flatpak (RHSA-2019:1024)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1024 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Sandbox bypass via IOCS...

Important: Red Hat Security Advisory: flatpak security update

An update for flatpak is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)

An incomplete fix for CVE-2017-5226 was found in flatpak. A sandbox bypass flaw was found in the way bubblewrap, which is used for sandboxing flatpak applications handled the TIOCSTI ioctl. A malicious flatpak application could use this flaw to inject commands into the controlled terminal of the...

Fedora Update for flatpak FEDORA-2018-2f9521c82e

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

flatpak security update

1.0.2-5 - Fix IOCSTI sandbox bypass 1700651...

Fedora Update for flatpak FEDORA-2018-009a65a873

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for flatpak FEDORA-2019-7d09431f07

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for flatpak FEDORA-2019-fd9345f44a

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 30 : flatpak (2019-2fd70709a5)

Update to 1.2.4 - seccomp: Only compare the low 32bit of the TIOCSTI ioctl args. - Support multiple nvidia cards on the machine - Fix support for systems where XDGRUNTIMEDIR is /var/run which is a symlink like gentoo. - Fix potential crash when updating apps. - flatpak list --arch now works...