Summary
bubblewrap
[0.4.0-2]
- Backport upstream fix to help address CVE-2024-42472 in flatpak
flatpak
[1.12.9-3]
- Fix previous changelog entry
[1.12.9-2]
- Backport upstream patches for CVE-2024-42472
- Require bubblewrap version that has new --bind-fd option backported for
addressing CVE-2024-42472
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bubblewrap | 0:0.4.0-2.el8_10 |
| Oracle Linux · 8 | flatpak | 0:1.12.9-3.el8_10 |
| Oracle Linux · 8 | flatpak-devel | 0:1.12.9-3.el8_10 |
| Oracle Linux · 8 | flatpak-libs | 0:1.12.9-3.el8_10 |
| Oracle Linux · 8 | flatpak-selinux | 0:1.12.9-3.el8_10 |
| Oracle Linux · 8 | flatpak-session-helper | 0:1.12.9-3.el8_10 |
Vulnerabilities 1
-
Critical 10.0
Flatpak may allow access to files outside sandbox for certain apps
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, whi…