Description
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | flatpak | 0.10.3-1 | — |
| Debian 13 | flatpak | 0.10.3-1 | — |
| Debian 12 | flatpak | 0.10.3-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | flatpak +3 | 0.8.8-4.el7_5 | RHSA-2018:2766 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | flatpak +3 | 0.8.8-4.amzn2 | ALAS2-2018-1096 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | flatpak +3 | 0.8.8-4.el7_5 | ELSA-2018-2766 |
Advisories 3
- RHSA-2018:2766 Red Hat Security Advisory: flatpak security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ALAS2-2018-1096 Moderate: flatpak security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 25, 2018
- ELSA-2018-2766 Moderate: flatpak security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 25, 2018