In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" component, files deployed as part of the app are owned by root, so in the worst case they could be setuid root.

This update for flatpak to version 0.8.9 fixes security issues and bugs.

The following vulnerabilities were fixed :

  - CVE-2018-6560: sandbox escape in the flatpak dbus proxy     (boo#1078923)

  - CVE-2017-9780: Malicious apps could have included     inappropriate permissions (boo#1078989)

  - old-style eavesdropping in the dbus proxy (boo#1078993)

This update also includes all upstream improvements and fixes in this stable release series.

Security fix for CVE-2017-9780

Update to 0.8.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Flatpak, an application deployment framework for desktop apps insufficiently restricted file permissinons in third-party repositories, which could result in privilege escalation.

ID	Name	Product	Family	Severity
106663	openSUSE Security Update : flatpak (openSUSE-2018-139)	Nessus	SuSE Local Security Checks	high
101505	Fedora 24 : flatpak (2017-6b1f07acd9)	Nessus	Fedora Local Security Checks	high
101012	Debian DSA-3895-1 : flatpak - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-9780

high

Tenable Plugins

high

high

high