Multiple vulnerabilities have been found in Flatpak, the worst of which allows sandbox escape.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/flatpak | * | < 1.16.4 | >= 1.16.4 |
Flatpak is a Linux application sandboxing and distribution framework.
Multiple vulnerabilities have been discovered in Flatpak. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Flatpak users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.16.4"
A vulnerability has been discovered in Flatpak, which can lead to a sandbox escape.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/flatpak | * | < 1.4.10 | >= 1.4.10 |
Flatpak is a Linux application sandboxing and distribution framework.
A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details.
A malicious or compromised Flatpak app using persistent directories could read and write files in locations it would not normally have access to.
There is no known workaround at this time.
All Flatpak users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.4.10"
A vulnerability has been discovered in Flatpak, which can lead to a sandbox escape.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/flatpak | * | < 1.14.6 | >= 1.14.6 |
Flatpak is a Linux application sandboxing and distribution framework.
A vulnerability has been discovered in Flatpak. Please review the CVE identifier referenced below for details.
A malicious or compromised Flatpak app could execute arbitrary code outside its sandbox in conjunction with xdg-desktop-portal.
There is no known workaround at this time.
All Flatpak users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.14.6"
Several vulnerabilities have been found in Flatpack, the worst of which lead to privilege escalation and sandbox escape.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/flatpak | * | < 1.14.4 | >= 1.14.4 |
Flatpak is a Linux application sandboxing and distribution framework.
Multiple vulnerabilities have been discovered in Flatpak. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Flatpak users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.14.4"
A vulnerability was discovered in Flatpak which could allow a remote attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| sys-apps/flatpak | * | < 1.10.0 | >= 1.10.0 |
Flatpak is a Linux application sandboxing and distribution framework.
A bug was discovered in the flatpak-portal service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape).
A remote attacker could entice a user to open a specially crafted Flatpak app possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
As a workaround, this vulnerability can be mitigated by preventing the flatpak-portal service from starting, but that mitigation will prevent many Flatpak apps from working correctly. It is highly recommended to upgrade.
All Flatpak users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/flatpak-1.10.0"