rpm package
almalinux/flatpak-selinux
pkg:rpm/almalinux/flatpak-selinux
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-34079 | Hig | 7.5 | < 1.12.9-4.el9_8.1 | 1.12.9-4.el9_8.1 | Apr 7, 2026 | Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete ar | |
| CVE-2026-34078 | Cri | 10.0 | < 1.12.9-4.el9_8.1 | 1.12.9-4.el9_8.1 | Apr 7, 2026 | Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This g | |
| CVE-2024-42472 | — | < 1.12.9-3.el9_4 | 1.12.9-3.el9_4 | Aug 15, 2024 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on in | ||
| CVE-2024-32462 | — | < 1.12.9-1.el9_4 | 1.12.9-1.el9_4 | Apr 18, 2024 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument | ||
| CVE-2023-28101 | — | < 1.12.8-1.el9 | 1.12.8-1.el9 | Mar 16, 2023 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatp | ||
| CVE-2023-28100 | — | < 1.12.8-1.el9 | 1.12.8-1.el9 | Mar 16, 2023 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak a | ||
| CVE-2021-43860 | — | < 1.8.7-1.el8 | 1.8.7-1.el8 | Jan 12, 2022 | Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the ca | ||
| CVE-2021-41133 | — | < 1.8.5-5.el8_5 | 1.8.5-5.el8_5 | Oct 8, 2021 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other ho |
- affected < 1.12.9-4.el9_8.1fixed 1.12.9-4.el9_8.1
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the caching for ld.so removes outdated cache files without properly checking that the app controlled path to the outdated cache is in the cache directory. This allows Flatpak apps to delete ar
- affected < 1.12.9-4.el9_8.1fixed 1.12.9-4.el9_8.1
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This g
- CVE-2024-42472Aug 15, 2024affected < 1.12.9-3.el9_4fixed 1.12.9-3.el9_4
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on in
- CVE-2024-32462Apr 18, 2024affected < 1.12.9-1.el9_4fixed 1.12.9-1.el9_4
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument
- CVE-2023-28101Mar 16, 2023affected < 1.12.8-1.el9fixed 1.12.8-1.el9
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the `flatp
- CVE-2023-28100Mar 16, 2023affected < 1.12.8-1.el9fixed 1.12.8-1.el9
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak a
- CVE-2021-43860Jan 12, 2022affected < 1.8.7-1.el8fixed 1.8.7-1.el8
Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the ca
- CVE-2021-41133Oct 8, 2021affected < 1.8.5-5.el8_5fixed 1.8.5-5.el8_5
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other ho