Most recent entries from all

ALSA-2024:3959 — Important: flatpak security update

Affected: AlmaLinux:9: flatpak, AlmaLinux:9: flatpak-devel, AlmaLinux:9: flatpak-libs, AlmaLinux:9: flatpak-selinux, AlmaLinux:9: flatpak-session-helper

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

* flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

bdu:2024-03113

certfr-2025-avi-0018 — De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent…

certfr-2025-avi-0018

CLEANSTART-2024-IL49391 — Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux

Affected: CleanStart: flatpak

Security vulnerability affects the flatpak package. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

EUVD-2026-263703

fkie_cve-2024-32462

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.

gsd-2024-32462

OESA-2024-1490 — flatpak security update

Affected: openEuler:20.03-LTS-SP1: flatpak, openEuler:20.03-LTS-SP4: flatpak, openEuler:22.03-LTS: flatpak, openEuler:22.03-LTS-SP1: flatpak, openEuler:22.03-LTS-SP2: flatpak, openEuler:22.03-LTS-SP3: flatpak

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fix(es): Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.(CVE-2024-32462)

openSUSE-SU-2024:13899-1 — flatpak-1.15.8-1.1 on GA media

flatpak-1.15.8-1.1 on GA media

RHSA-2024:3960 — Red Hat Security Advisory: flatpak security update

flatpak: sandbox escape via RequestBackground portal

SUSE-RU-2025:0145-1 — Recommended update for bubblewrap, flatpak, wayland-protocols

Recommended update for bubblewrap, flatpak, wayland-protocols

UBUNTU-CVE-2024-32462

Affected: Ubuntu:Pro:18.04:LTS: flatpak, Ubuntu:Pro:20.04:LTS: flatpak, Ubuntu:Pro:22.04:LTS: flatpak, Ubuntu:24.04:LTS: flatpak

WID-SEC-W-2024-1398 — Red Hat Enterprise Linux (Flatpak): Schwachstelle ermöglicht Codeausführung

Ein lokaler Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen.