Oracle Linux 9 : bubblewrap / and / flatpak (ELSA-2024-9449)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-9449 advisory. - Backport upstream fix to help address CVE-2024-42472 in flatpak flatpak - Backport upstream patches for CVE-2024-42472 Tenable has extracted the preceding...

bubblewrap and flatpak security update

bubblewrap 0.4.1-8 - Backport upstream fix to help address CVE-2024-42472 in flatpak flatpak 1.12.9-3 - Fix previous changelog entry 1.12.9-2 - Backport upstream patches for CVE-2024-42472 - Require bubblewrap version that has new --bind-fd option backported for addressing CVE-2024-42472...

Fedora 41 : flatpak (2024-0c6db96fc3)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0c6db96fc3 advisory. Update to 1.15.10 CVE-2024-42472 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

RHSA-2024:9449 Red Hat Security Advisory: bubblewrap and flatpak security update

Bulletin has no description...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

Important: Red Hat Security Advisory: bubblewrap and flatpak security update

An update for bubblewrap and flatpak is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: bubblewrap and flatpak security update

Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fixes: flatpak: Access to files outside sandbox for apps using persistent= --persist CVE-2024-42472 For more details about the security issue...

ALSA-2024:9449 Important: bubblewrap and flatpak security update

Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces. Security Fixes: flatpak: Access to files outside sandbox for apps using persistent= --persist CVE-2024-42472 For more details about the security issue...

RHEL 9 : bubblewrap and flatpak (RHSA-2024:9449)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9449 advisory. Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces...

Low: Red Hat Bug Fix Advisory: updated el9/flatpak-sdk container image

Updated el9/flatpak-sdk container image is now available for Red Hat Enterprise Linux 9. The el9/flatpak-sdk container image has been updated for Red Hat Enterprise Linux 9 to address the following security advisory: RHSA-2024:8617 see References Users of el9/flatpak-sdk container images are...

Flatpak: Sandbox Escape

Background Flatpak is a Linux application sandboxing and distribution framework. Description A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details. Impact A malicious or compromised Flatpak app using persistent directories could read and wri...

GLSA-202411-02 : Flatpak: Sandbox Escape

The remote host is affected by the vulnerability described in GLSA-202411-02 Flatpak: Sandbox Escape A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly from the Gentoo Linux...

Important: flatpak

Issue Overview: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files...

Amazon Linux 2023 : flatpak, flatpak-devel, flatpak-libs (ALAS2023-2024-745)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-745 advisory. A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can...

Important: flatpak

Issue Overview: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files...

Advisory ROSA-SA-2024-2508

Software: flatpak 1.0.9 OS: rosa-server79 packageevrstring: flatpak-1.0.9-13.0.1.res7 CVE-ID: CVE-2024-42472 BDU-ID: 2024-06671 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Flatpak application and environment management tool is related to improper neutralization of special output elements use...

Moderate: Red Hat Bug Fix Advisory: Updated rhel8/gimp-flatpak container image

An updated rhel8/gimp-flatpak container image is now available in the Red Hat container registry. To pull a container image, run the following command: podman pull registry.redhat.io/...

Important: Red Hat Bug Fix Advisory: Updated rhel9/thunderbird-flatpak container image

An updated rhel9/thunderbird-flatpak container image is now available in the Red Hat container registry. Mozilla Thunderbird is a standalone mail and newsgroup client. Flatpak is a system for running graphical applications as containers. Installing an application as a Flatpak rather than as an...

Important: Red Hat Bug Fix Advisory: Updated rhel9/firefox-flatpak container image

An updated rhel9/firefox-flatpak container image is now available in the Red Hat container registry. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Flatpak is a system for running graphical applications as containers. Installing an...

Important: bubblewrap

Issue Overview: A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files...