Skip to content
OpenAdvisories
Critical RHSA-2023:6518 2 CVEs

Red Hat Security Advisory: flatpak security, bug fix, and enhancement update

Published Sep 16, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 17

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-debuginfo 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-debugsource 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-libs 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-libs-debuginfo 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-selinux 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-session-helper 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-session-helper-debuginfo 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::appstream flatpak-tests-debuginfo 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-debuginfo 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-debugsource 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-devel 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-libs-debuginfo 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-session-helper 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-session-helper-debuginfo 0:1.12.8-1.el9
Red Hat · RHEL 9 enterprise_linux:9::crb flatpak-tests-debuginfo 0:1.12.8-1.el9

Vulnerabilities 2

  • Critical 10.0
    CVE-2023-28100

    TIOCLINUX can send commands outside sandbox if running on a virtual console

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIO…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu
  • Medium 5.0
    CVE-2023-28101

    Flatpak metadata with ANSI control codes can cause misleading terminal output

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions fro…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2179219
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2179220
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2221792
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6518.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-28100
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-28100
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-28100
  • article
    https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp
  • report
    https://access.redhat.com/security/cve/CVE-2023-28101
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-28101
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-28101
  • article
    https://github.com/flatpak/flatpak/security/advisories/GHSA-h43h-fwqx-mpp8