Summary
It was discovered that Flatpak incorrectly handled certain persisted
directories. An attacker could possibly use this issue to read
and write files in locations it would not normally have access to.
A patch was also needed to Bubblewrap in order to avoid race
conditions caused by this fix.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | bubblewrap | 0.4.0-1ubuntu4.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | flatpak | 1.6.5-0ubuntu0.5 |
| Ubuntu · 22.04 LTS 22.04:LTS | bubblewrap | 0.6.1-1ubuntu0.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | flatpak | 1.12.7-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | bubblewrap | 0.9.0-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | flatpak | 1.14.6-1ubuntu0.1 |
Vulnerabilities 1
-
Critical 10.0
Flatpak may allow access to files outside sandbox for certain apps
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, whi…