https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:04:59 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:6356 <p><strong>Affected:</strong> AlmaLinux:9: bubblewrap, AlmaLinux:9: flatpak, AlmaLinux:9: flatpak-devel, AlmaLinux:9: flatpak-libs, AlmaLinux:9: flatpak-selinux, AlmaLinux:9: flatpak-session-helper</p> <p>Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.</p> <p>Security Fix(es):</p> <p>* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: bubblewrap, AlmaLinux:9: flatpak, AlmaLinux:9: flatpak-devel, AlmaLinux:9: flatpak-libs, AlmaLinux:9: flatpak-selinux, AlmaLinux:9: flatpak-session-helper</p> <p>Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.</p> <p>Security Fix(es):</p> <p>* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:6356 https://cve.radiocsirt.org/vuln/bdu:2024-06671 bdu:2024-06671 https://cve.radiocsirt.org/vuln/bdu:2024-06671 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0741 certfr-2024-avi-0741 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0741 https://cve.radiocsirt.org/vuln/cleanstart-2024-ul58888 <p><strong>Affected:</strong> CleanStart: flatpak</p> <p>Security vulnerability affects the flatpak package. Flatpak is a Linux application sandboxing and distribution framework.</p> <p><strong>Affected:</strong> CleanStart: flatpak</p> <p>Security vulnerability affects the flatpak package. Flatpak is a Linux application sandboxing and distribution framework.</p> https://cve.radiocsirt.org/vuln/cleanstart-2024-ul58888 https://cve.radiocsirt.org/vuln/euvd-2026-226756 EUVD-2026-226756 https://cve.radiocsirt.org/vuln/euvd-2026-226756 https://cve.radiocsirt.org/vuln/fkie_cve-2024-42472 <p>Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.</p> <p>When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn&#39;t have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.</p> <p>However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.</p> <p>Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running…</p> <p>Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.</p> <p>When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn&#39;t have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.</p> <p>However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.</p> <p>Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-42472 https://cve.radiocsirt.org/vuln/oesa-2024-2053 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: flatpak, openEuler:20.03-LTS-SP4: flatpak, openEuler:22.03-LTS-SP1: flatpak, openEuler:24.03-LTS: flatpak, openEuler:22.03-LTS-SP4: flatpak</p> <p>flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.</p> <p>Security Fix(es):</p> <p>Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.</p> <p>When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn&amp;apos;t have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.</p> <p>However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.</p> <p>Partial protection against this vulnerabili…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: flatpak, openEuler:20.03-LTS-SP4: flatpak, openEuler:22.03-LTS-SP1: flatpak, openEuler:24.03-LTS: flatpak, openEuler:22.03-LTS-SP4: flatpak</p> <p>flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.</p> <p>Security Fix(es):</p> <p>Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.</p> <p>When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn&amp;apos;t have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.</p> <p>However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.</p> <p>Partial protection against this vulnerabili…</p> https://cve.radiocsirt.org/vuln/oesa-2024-2053 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14269-1 <p>bubblewrap-0.10.0-1.1 on GA media</p> <p>bubblewrap-0.10.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14269-1 https://cve.radiocsirt.org/vuln/rhsa-2024:6355 <p>flatpak: Access to files outside sandbox for apps using persistent= (--persist)</p> <p>flatpak: Access to files outside sandbox for apps using persistent= (--persist)</p> https://cve.radiocsirt.org/vuln/rhsa-2024:6355 https://cve.radiocsirt.org/vuln/suse-ru-2025:0145-1 <p>Recommended update for bubblewrap, flatpak, wayland-protocols</p> <p>Recommended update for bubblewrap, flatpak, wayland-protocols</p> https://cve.radiocsirt.org/vuln/suse-ru-2025:0145-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-42472 <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: flatpak, Ubuntu:20.04:LTS: flatpak, Ubuntu:22.04:LTS: flatpak, Ubuntu:24.04:LTS: flatpak</p> <p>Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn&#39;t have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in…</p> <p><strong>Affected:</strong> Ubuntu:Pro:18.04:LTS: flatpak, Ubuntu:20.04:LTS: flatpak, Ubuntu:22.04:LTS: flatpak, Ubuntu:24.04:LTS: flatpak</p> <p>Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn&#39;t have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in…</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-42472 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2059 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2059