Skip to content
OpenAdvisories
High RLSA-2021:4042 1 CVE

Important: flatpak security update

Published Nov 1, 2021 · Updated Feb 4, 2026

Ecosystem: Rocky Linux

Summary

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

* flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
Rocky Linux · 8 flatpak 0:1.8.5-4.el8_4
Rocky Linux · 8 flatpak 0:1.8.5-4.el8

Vulnerabilities 1

  • High 8.8
    CVE-2021-41133

    Sandbox bypass via recent VFS-manipulating syscalls

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick…

    Flatpak Flatpak flatpak flatpak Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2012245