CVE-2019-8308
Fixed in a distro release EPSS <1%
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.
Products: flatpak, debian_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | flatpak | 1.0.2-4.amzn2.0.1 |
| Amazon Linux 2 | flatpak-builder | 1.0.0-4.amzn2.0.1 |
| Amazon Linux 2 | flatpak-devel | 1.0.2-4.amzn2.0.1 |
| Amazon Linux 2 | flatpak-libs | 1.0.2-4.amzn2.0.1 |
| Debian 12 | flatpak | 1.2.3-1 |
| Debian 13 | flatpak | 1.2.3-1 |
| Debian 14 | flatpak | 1.2.3-1 |
| Debian 9 | flatpak | 0.8.9-0+deb9u2 |
| Red Hat Enterprise Linux 7 | flatpak | 0:1.0.2-4.el7_6 |
| Red Hat Enterprise Linux 7 | flatpak-builder | 0:1.0.0-4.el7_6 |
| Red Hat Enterprise Linux 7 | flatpak-debuginfo | 0:1.0.2-4.el7_6 |
| Red Hat Enterprise Linux 7 | flatpak-devel | 0:1.0.2-4.el7_6 |
| Red Hat Enterprise Linux 7 | flatpak-libs | 0:1.0.2-4.el7_6 |
| SUSE Linux Enterprise Module for Desktop Applications 15 | flatpak | 0.10.4-4.10.1 |
| Ubuntu 18.04 LTS | flatpak | 1.0.7-0ubuntu0.18.04.1 |
| openSUSE Leap 15.0 | flatpak | 0.10.4-lp150.8.1 |