CVE-2023-28100
Fixed in a distro release EPSS <1%CVSS 10.0
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.
Products: flatpak
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | flatpak | 1.10.8-1.el8 |
| AlmaLinux 8 | flatpak-devel | 1.10.8-1.el8 |
| AlmaLinux 8 | flatpak-libs | 1.10.8-1.el8 |
| AlmaLinux 8 | flatpak-selinux | 1.10.8-1.el8 |
| AlmaLinux 8 | flatpak-session-helper | 1.10.8-1.el8 |
| AlmaLinux 9 | flatpak | 1.12.8-1.el9 |
| AlmaLinux 9 | flatpak-devel | 1.12.8-1.el9 |
| AlmaLinux 9 | flatpak-libs | 1.12.8-1.el9 |
| AlmaLinux 9 | flatpak-selinux | 1.12.8-1.el9 |
| AlmaLinux 9 | flatpak-session-helper | 1.12.8-1.el9 |
| Amazon Linux 2 | flatpak | 1.0.9-10.amzn2.0.3 |
| Amazon Linux 2 | flatpak-builder | 1.0.0-10.amzn2.0.3 |
| Amazon Linux 2 | flatpak-devel | 1.0.9-10.amzn2.0.3 |
| Amazon Linux 2 | flatpak-libs | 1.0.9-10.amzn2.0.3 |
| Debian 12 | flatpak | 1.14.4-1 |
| Debian 13 | flatpak | 1.14.4-1 |
| Debian 14 | flatpak | 1.14.4-1 |
| Red Hat Enterprise Linux 8 | flatpak | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-debuginfo | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-debugsource | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-devel | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-libs | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-libs-debuginfo | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-selinux | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper-debuginfo | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 8 | flatpak-tests-debuginfo | 0:1.10.8-1.el8 |
| Red Hat Enterprise Linux 9 | flatpak | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-debuginfo | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-debugsource | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-devel | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-libs | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-libs-debuginfo | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-selinux | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper-debuginfo | 0:1.12.8-1.el9 |
| Red Hat Enterprise Linux 9 | flatpak-tests-debuginfo | 0:1.12.8-1.el9 |
| Rocky Linux 9 | flatpak | 0:1.12.8-1.el9 |
| SUSE Enterprise Storage 7 | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Enterprise Storage 7.1 | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | flatpak | 1.2.3-150100.4.11.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP4 | flatpak | 1.12.8-150400.3.3.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Server 12 SP5 | flatpak | 1.4.2-3.3.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | flatpak | 1.2.3-150100.4.11.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | flatpak | 1.4.2-3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | flatpak | 1.2.3-150100.4.11.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | flatpak | 1.10.8-150200.4.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | flatpak | 1.10.8-150200.4.15.1 |
| Ubuntu 25.10 | flatpak | no fix |
| Ubuntu 26.04 LTS | flatpak | no fix |
| Ubuntu 26.10 | flatpak | no fix |
| Ubuntu Pro 18.04 LTS | flatpak | no fix |
| Ubuntu Pro 20.04 LTS | flatpak | no fix |
| Ubuntu Pro 22.04 LTS | flatpak | no fix |
| Ubuntu Pro 24.04 LTS | flatpak | no fix |
| openSUSE Leap 15.4 | flatpak | 1.12.8-150400.3.3.1 |
| openSUSE Tumbleweed | flatpak | 1.14.4-1.1 |