CVE-2018-6560
02.02.2018, 14:29
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.Enginsight
| Vendor | Product | Version |
|---|---|---|
| flatpak | flatpak | 𝑥 < 0.8.9 |
| flatpak | flatpak | 0.9.1 ≤ 𝑥 ≤ 0.9.99 |
| flatpak | flatpak | 0.10.0 ≤ 𝑥 < 0.10.3 |
| redhat | enterprise_linux_desktop | 7.0 |
| redhat | enterprise_linux_server | 7.0 |
| redhat | enterprise_linux_server_aus | 7.6 |
| redhat | enterprise_linux_server_eus | 7.5 |
| redhat | enterprise_linux_server_eus | 7.6 |
| redhat | enterprise_linux_server_tus | 7.6 |
| redhat | enterprise_linux_workstation | 7.0 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
References