Red Hat Security AdvisoryRHSA-2019:0375
flatpak security update
Released 2019-02-19 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) flatpak-1.0.2-4.el7_6, flatpak-libs-1.0.2-4.el7_6
- Red Hat Enterprise Linux Client Optional (v. 7) flatpak-builder-1.0.0-4.el7_6, flatpak-devel-1.0.2-4.el7_6
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) flatpak-1.0.2-4.el7_6, flatpak-builder-1.0.0-4.el7_6, flatpak-devel-1.0.2-4.el7_6 +1
- Red Hat Enterprise Linux Server (v. 7) flatpak-1.0.2-4.el7_6, flatpak-libs-1.0.2-4.el7_6
- Red Hat Enterprise Linux Server Optional (v. 7) flatpak-builder-1.0.0-4.el7_6, flatpak-devel-1.0.2-4.el7_6
- Red Hat Enterprise Linux Workstation (v. 7) flatpak-1.0.2-4.el7_6, flatpak-libs-1.0.2-4.el7_6
- Red Hat Enterprise Linux Workstation Optional (v. 7) flatpak-builder-1.0.0-4.el7_6, flatpak-devel-1.0.2-4.el7_6
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) flatpak-1.0.2-4.el7_6, flatpak-libs-1.0.2-4.el7_6
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) flatpak-builder-1.0.0-4.el7_6, flatpak-devel-1.0.2-4.el7_6
Fixes 1 record
Priority LOW 36
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.
CVSS 3.0HIGH 8.2· Local · Low privileges · User interaction · EPSS 0.00466 · Published 2019-02-12 · Fixed CWE-668
