CLSA-2025-1741291194 flatpak: Fix of CVE-2024-42472

CVE-2024-42472: patch Flatpak to include the new --bind-fd option in bubblewrap to prevent symlink attacks on persistent directories...

CLSA-2025-1741215879 flatpak: Fix of CVE-2024-32462

CVE-2024-32462: mitigate sandbox escape by passing the -- argument to bwrap...

Linux Distros Unpatched Vulnerability : CVE-2024-42472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using...

CLSA-2025-1741125454 bubblewrap: Fix of CVE-2024-42472

fix CVE-2024-42472 in flatpak by adding --bind-fd and --ro-bind-fd options in in bubblewrap, enabling race-free bind mounts using an OPATH file descriptor instead of a direct path...

CLSA-2025-1740740956 flatpak: Fix of CVE-2023-28101

CVE-2023-28101: fix issue of hiding elevated permissions by setting crafted values containing non-printable control characters...

CLSA-2025-1740132708 flatpak: Fix of CVE-2023-28100

CVE-2023-28100: fix issue where Flatpak could copy text from Linux virtual console and paste it into command buffer, potentially leading to command execution...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.103003)

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.103003 advisory. - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overfl...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.102005)

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.102005 advisory. - An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overfl...

SUSE SLED15: bubblewrap / bubblewrap-zsh-completion / flatpak / flatpak-devel / etc (SUSE-SU-SUSE-RU-2025:0145-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-RU-2025:0145-1 advisory. This update for bubblewrap, flatpak updates flatpak to 1.16.0. flatpak changes: - Update...

SUSE-RU-2025:0145-1 Recommended update for bubblewrap, flatpak, wayland-protocols

This update for bubblewrap, flatpak updates flatpak to 1.16.0. flatpak changes: - Update to version 1.16.0: + Bug fixes: - Update libglnx to 2024-12-06: . Fix an assertion failure if creating a parent directory encounters a dangling symlink. . Fix a Meson warning. . Don't emit terminal progress...

Amazon Linux 2 : flatpak (ALAS-2024-2712)

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2712 advisory. A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This fl...

Important: flatpak

Issue Overview: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files...

Important: flatpak

Issue Overview: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files...

Amazon Linux 2022 : flatpak, flatpak-devel, flatpak-libs (ALAS2022-2022-021)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-021 advisory. An incorrect authorization vulnerability was found in Flatpak. Flatpak does not properly validate that the permissions displayed to the user for an app at install time match the actual...

Moderate: Red Hat Bug Fix Advisory: Updated rhel9/firefox-flatpak container image

An updated rhel9/firefox-flatpak container image is now available in the Red Hat container registry. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Flatpak is a system for running graphical applications as containers. Installing an...

Moderate: Red Hat Bug Fix Advisory: Updated rhel9/thunderbird-flatpak container image

An updated rhel9/thunderbird-flatpak container image is now available in the Red Hat container registry. Mozilla Thunderbird is a standalone mail and newsgroup client. Flatpak is a system for running graphical applications as containers. Installing an application as a Flatpak rather than as an...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app that used persistent directories could access and write files outside of its usual access rights, which constituted an attack on integrity and...

bubblewrap and flatpak security update

An update is available for bubblewrap. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged...

RLSA-2024:9449 Important: bubblewrap and flatpak security update

Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fixes: flatpak: Access to files outside sandbox for apps using persistent= --persist CVE-2024-42472 For more details about the security issue...

RockyLinux 9 : bubblewrap and flatpak (RLSA-2024:9449)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:9449 advisory. flatpak: Access to files outside sandbox for apps using persistent= --persist CVE-2024-42472 Tenable has extracted the preceding description block directly from t...