Skip to content
OpenAdvisories
Medium ELSA-2023-6518 2 CVEs

Moderate: flatpak security, bug fix, and enhancement update (Oracle Linux 9)

Published Nov 11, 2023 · Updated Nov 11, 2023

Ecosystem: Oracle Linux

Summary

[1.12.8-1]
- Update to 1.12.8 (CVE-2023-28100, CVE-2023-28101)
Resolves: #2180312, #2221792

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 9 flatpak 0:1.12.8-1.el9
Oracle Linux · 9 flatpak-devel 0:1.12.8-1.el9
Oracle Linux · 9 flatpak-libs 0:1.12.8-1.el9
Oracle Linux · 9 flatpak-selinux 0:1.12.8-1.el9
Oracle Linux · 9 flatpak-session-helper 0:1.12.8-1.el9

Vulnerabilities 2

  • Critical 10.0
    CVE-2023-28100

    TIOCLINUX can send commands outside sandbox if running on a virtual console

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIO…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu
  • Medium 5.0
    CVE-2023-28101

    Flatpak metadata with ANSI control codes can cause misleading terminal output

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions fro…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu