Red Hat Security AdvisoryRHSA-2018:2766
flatpak security update
Released 2018-09-25 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) flatpak-0.8.8-4.el7_5, flatpak-libs-0.8.8-4.el7_5
- Red Hat Enterprise Linux Client Optional (v. 7) flatpak-builder-0.8.8-4.el7_5, flatpak-devel-0.8.8-4.el7_5
- Red Hat Enterprise Linux Server (v. 7) flatpak-0.8.8-4.el7_5, flatpak-libs-0.8.8-4.el7_5
- Red Hat Enterprise Linux Server Optional (v. 7) flatpak-builder-0.8.8-4.el7_5, flatpak-devel-0.8.8-4.el7_5
- Red Hat Enterprise Linux Workstation (v. 7) flatpak-0.8.8-4.el7_5, flatpak-libs-0.8.8-4.el7_5
- Red Hat Enterprise Linux Workstation Optional (v. 7) flatpak-builder-0.8.8-4.el7_5, flatpak-devel-0.8.8-4.el7_5
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) flatpak-0.8.8-4.el7_5, flatpak-libs-0.8.8-4.el7_5
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) flatpak-builder-0.8.8-4.el7_5, flatpak-devel-0.8.8-4.el7_5
Fixes 1 record
Priority LOW 38
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not ident…
CVSS 3.0HIGH 8.8· Local · Low privileges · No interaction · EPSS 0.00412 · Published 2018-02-02 · Fixed CWE-436
