Most recent entries from all

ALSA-2022:7458 — Moderate: flatpak-builder security and bug fix update

Affected: AlmaLinux:8: flatpak-builder

Flatpak-builder is a tool for building flatpaks from sources.

Security Fix(es):

* flatpak: flatpak-builder --mirror-screenshots-url can access files outside the build directory (CVE-2022-21682)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

CLEANSTART-2024-GX04243 — Flatpak is a Linux application sandboxing and distribution framework

Affected: CleanStart: flatpak, CleanStart: flatpak-builder

CVE-2022-21682 affects multiple packages. Flatpak is a Linux application sandboxing and distribution framework. See references for individual vulnerability details.

cnvd-2022-08917

EUVD-2026-13261

fkie_cve-2022-21682

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.

gsd-2022-21682

OESA-2022-1788 — flatpak-builder security update

Affected: openEuler:22.03-LTS: flatpak-builder

Flatpak-builder is a tool for building flatpaks from sources. Security Fix(es): Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the build. At this point the build directory will have the full access that is specified in the manifest, so running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these empty directories can be created wherever the user has write permissions. However, a malicious application could replace the `appstream-util` binary and potentially do something more hostile. This has been resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and `--nofilesystem=host`.(CVE-2022-21682)

openSUSE-SU-2022:0712-1 — Security update for flatpak

Security update for flatpak

SUSE-SU-2022:0712-1 — Security update for flatpak

Security update for flatpak

UBUNTU-CVE-2022-21682

Affected: Ubuntu:Pro:18.04:LTS: flatpak, Ubuntu:Pro:20.04:LTS: flatpak, Ubuntu:Pro:22.04:LTS: flatpak

WID-SEC-W-2022-2044 — Red Hat Enterprise Linux: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen, Dateien zu manipulieren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.