ROS-20240507-06

A vulnerability in the xdg-desktop-portal interface of the Flatpak application and environment management tool is related to the injection or modification of arguments. Exploitation of the vulnerability could allow an attacker to to exit an isolated program environment and access files on the...

SUSE: Security Advisory (SUSE-SU-2024:1535-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: flatpak / flatpak-devel / flatpak-remote-flathub / etc (SUSE-SU-2024:1536-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1536-1 advisory. - CVE-2024-32462: Fixed arbitrary code execution outside sandbox via malicious app due to insufficient...

SUSE SLES15: flatpak / flatpak-devel / flatpak-zsh-completion / libflatpak0 / etc (SUSE-SU-2024:1535-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1535-1 advisory. - CVE-2024-32462: Fixed arbitrary code execution outside sandbox via malicious app due to insufficient 'command' argument sanitization...

SUSE-SU-2024:1536-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2024-32462: Fixed arbitrary code execution outside sandbox via malicious app due to insufficient 'command' argument sanitization bsc1223110...

SUSE-SU-2024:1535-1 Security update for flatpak

This update for flatpak fixes the following issues: - CVE-2024-32462: Fixed arbitrary code execution outside sandbox via malicious app due to insufficient 'command' argument sanitization bsc1223110...

Fedora 40 : flatpak (2024-43ea98691e)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-43ea98691e advisory. Update to 1.15.8 Fixes CVE-2024-32462 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

OESA-2024-1490 flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fixes: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in...

Arbitrary Code Execution

Flatpak is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper handling of the --command argument to the portal interface org.freedesktop.portal.Background.RequestBackground from within a Flatpak app, which allows malicious or compromised Flatpak apps to pass bwrap...

[SECURITY] Fedora 39 Update: flatpak-1.15.8-1.fc39

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information...

Fedora 39 : flatpak (2024-c8d21fe399)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-c8d21fe399 advisory. Update to 1.15.8 Fix CVE-2024-32462 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

Debian: Security Advisory (DSA-5666-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE CVE-2024-32462

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of flatpak run...

[SECURITY] [DSA 5666-1] flatpak security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5666-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 19, 2024 https://www.debian.org/security/faq -...

The vulnerability of the xdg-desktop-portal interface of the application and Flatpak environments allows a attacker to exit from the isolated software environment and gain access to files on the host system.

The vulnerability of the xdg-desktop-portal interface of the application and Flatpak environments is related to the implementation or modification of arguments. Exploiting this vulnerability can allow an attacker to exit from a isolated software environment and gain access to files on the host...

DSA-5666-1 flatpak - security update

Bulletin has no description...

Debian dsa-5666 : flatpak - security update

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5666 advisory. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5666-1...

CVE-2024-32462

A flaw was found in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. Normally, the "--command" argument of "flatpak run" expects being given a command to run in the specified Flatpak app, along with optional arguments. However, it is possible to...

CVE-2024-32462

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of flatpak run...

DEBIAN-CVE-2024-32462

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of flatpak run...