Summary
bubblewrap
[0.4.1-7]
- Add support for --bind-fd and --ro-bind-fd (CVE-2024-42472)
flatpak
[1.12.9-3]
- Fix previous changelog entry
[1.12.9-2]
- Backport upstream patches for CVE-2024-42472
- Require bubblewrap version that has new --bind-fd option backported for
addressing CVE-2024-42472
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bubblewrap | 0:0.4.1-7.el9_4 |
| Oracle Linux · 9 | flatpak | 0:1.12.9-3.el9_4 |
| Oracle Linux · 9 | flatpak-devel | 0:1.12.9-3.el9_4 |
| Oracle Linux · 9 | flatpak-libs | 0:1.12.9-3.el9_4 |
| Oracle Linux · 9 | flatpak-selinux | 0:1.12.9-3.el9_4 |
| Oracle Linux · 9 | flatpak-session-helper | 0:1.12.9-3.el9_4 |
Vulnerabilities 1
-
Critical 10.0
Flatpak may allow access to files outside sandbox for certain apps
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, whi…