Skip to content
OpenAdvisories
Medium ELSA-2023-7038 2 CVEs

Moderate: flatpak security, bug fix, and enhancement update (Oracle Linux 8)

Published Nov 17, 2023 · Updated Nov 17, 2023

Ecosystem: Oracle Linux

Summary

[1.10.8-1]
- Rebase to 1.10.8 (#2222103)
- Fix CVE-2023-28100 and CVE-2023-28101 (#2180311)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 8 flatpak 0:1.10.8-1.el8
Oracle Linux · 8 flatpak-devel 0:1.10.8-1.el8
Oracle Linux · 8 flatpak-libs 0:1.10.8-1.el8
Oracle Linux · 8 flatpak-selinux 0:1.10.8-1.el8
Oracle Linux · 8 flatpak-session-helper 0:1.10.8-1.el8

Vulnerabilities 2

  • Critical 10.0
    CVE-2023-28100

    TIOCLINUX can send commands outside sandbox if running on a virtual console

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIO…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu
  • Medium 5.0
    CVE-2023-28101

    Flatpak metadata with ANSI control codes can cause misleading terminal output

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions fro…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu