Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be used in a Wayland or X11 graphical environment.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version MAIN 7.02, has flatpak packages installed that are affected by multiple vulnerabilities:

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0066 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-28100:
    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment.

    CVE-2023-28101:
    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6518 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the flatpak-1.12.8-1.el9 build changelog.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202312-12 (Flatpak: Multiple Vulnerabilities)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the file forwarding     feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by     the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak     app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had     chosen to open a target file with their Flatpak app, which automatically makes that file available to the     Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit `Disallow @@ and @@U     usage in desktop files`. The follow-up commits `dir: Reserve the whole @@ prefix` and `dir: Refuse to     export .desktop files with suspicious uses of @@ tokens` are recommended, but not strictly required. As a     workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported     `.desktop` files in `exports/share/applications/*.desktop` (typically     `~/.local/share/flatpak/exports/share/applications/*.desktop` and     `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow     `@@` or `@@u`. (CVE-2021-21381)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used     by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the     Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating     the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in     order to substitute a crafted `/.flatpak-info` or make that file disappear entirely. Flatpak apps that act     as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the     privileges that the corresponding services will believe the Flatpak app has. Note that protocols that     operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected     by this. This is due to the use of a proxy process `xdg-dbus-proxy`, whose VFS cannot be manipulated by     the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as     of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from     upgrading to a patched version. (CVE-2021-41133)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6,     Flatpak doesn't properly validate that the permissions displayed to the user for an app at install time     match the actual permissions granted to the app at runtime, in the case that there's a null byte in the     metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user.
    Flatpak shows permissions to the user during install by reading them from the xa.metadata key in the     commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak     compares these permissions to the *actual* metadata, from the metadata file to ensure it wasn't lied to.
    However, the actual metadata contents are loaded in several places where they are read as simple C-style     strings. That means that, if the metadata file includes a null terminator, only the content of the file     from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the     metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously     crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted     sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an     update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the     permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.
    (CVE-2021-43860)

  - Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability     affects versions of Flatpak prior to 1.12.3 and 1.10.6. flatpak-builder applies `finish-args` last in the     build. At this point the build directory will have the full access that is specified in the manifest, so     running `flatpak build` against it will gain those permissions. Normally this will not be done, so this is     not problem. However, if `--mirror-screenshots-url` is specified, then flatpak-builder will launch     `flatpak build --nofilesystem=host appstream-utils mirror-screenshots` after finalization, which can lead     to issues even with the `--nofilesystem=host` protection. In normal use, the only issue is that these     empty directories can be created wherever the user has write permissions. However, a malicious application     could replace the `appstream-util` binary and potentially do something more hostile. This has been     resolved in Flatpak 1.12.3 and 1.10.6 by changing the behaviour of `--nofilesystem=home` and     `--nofilesystem=host`. (CVE-2022-21682)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7038 advisory.

    [1.10.8-1]
    - Rebase to 1.10.8 (#2222103)
    - Fix CVE-2023-28100 and CVE-2023-28101 (#2180311)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6518 advisory.

    [1.12.8-1]
    - Update to 1.12.8 (CVE-2023-28100, CVE-2023-28101)     Resolves: #2180312, #2221792

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7038 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    The following packages have been upgraded to a later upstream version: flatpak (1.10.8). (BZ#2222103)

    Security Fix(es):

    * flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100)

    * flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7038 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6518 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

    The following packages have been upgraded to a later upstream version: flatpak (1.12.8). (BZ#2221792)

    Security Fix(es):

    * flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100)

    * flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2134 advisory.

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the TIOCLINUX ioctl command instead of TIOCSTI. If a Flatpak app is run on a Linux virtual console     such as /dev/tty1, it can copy text from the virtual console and paste it into the command buffer, from     which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators     like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual     consoles /dev/tty1, /dev/tty2 and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and     1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be     used in a Wayland or X11 graphical environment. (CVE-2023-28100)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1713-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1715-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1714-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1712-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9fbc701e0d advisory.

    Update to 1.12.8

    * Fix CVE-2023-28100 and CVE-2023-28101

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b0717d8c45 advisory.

    Update to 1.14.4

    * Fix CVE-2023-28100 and CVE-2023-28101

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-508e400dec advisory.

    Update to 1.15.4

    * Fix CVE-2023-28100 and CVE-2023-28101

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
258291	Linux Distros Unpatched Vulnerability : CVE-2023-28100	Nessus	Misc.	medium
242817	NewStart CGSL MAIN 7.02 : flatpak Multiple Vulnerabilities (NS-SA-2025-0146)	Nessus	NewStart CGSL Local Security Checks	medium
236364	Alibaba Cloud Linux 3 : 0066: flatpak (ALINUX3-SA-2024:0066)	Nessus	Alibaba Cloud Linux Local Security Checks	medium
196980	Rocky Linux 9 : flatpak (RLSA-2023:6518)	Nessus	Rocky Linux Local Security Checks	medium
191390	CentOS 9 : flatpak-1.12.8-1.el9	Nessus	CentOS Local Security Checks	medium
187282	GLSA-202312-12 : Flatpak: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
186096	Oracle Linux 8 : flatpak (ELSA-2023-7038)	Nessus	Oracle Linux Local Security Checks	medium
185824	Oracle Linux 9 : flatpak (ELSA-2023-6518)	Nessus	Oracle Linux Local Security Checks	medium
185695	RHEL 8 : flatpak (RHSA-2023:7038)	Nessus	Red Hat Local Security Checks	medium
185635	CentOS 8 : flatpak (CESA-2023:7038)	Nessus	CentOS Local Security Checks	medium
185103	RHEL 9 : flatpak (RHSA-2023:6518)	Nessus	Red Hat Local Security Checks	medium
178541	Amazon Linux 2 : flatpak (ALAS-2023-2134)	Nessus	Amazon Linux Local Security Checks	medium
173775	SUSE SLES15 Security Update : flatpak (SUSE-SU-2023:1713-1)	Nessus	SuSE Local Security Checks	medium
173772	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : flatpak (SUSE-SU-2023:1715-1)	Nessus	SuSE Local Security Checks	medium
173770	SUSE SLES15 Security Update : flatpak (SUSE-SU-2023:1714-1)	Nessus	SuSE Local Security Checks	medium
173766	SUSE SLES12 Security Update : flatpak (SUSE-SU-2023:1712-1)	Nessus	SuSE Local Security Checks	medium
173750	Fedora 36 : flatpak (2023-9fbc701e0d)	Nessus	Fedora Local Security Checks	medium
173395	Fedora 37 : flatpak (2023-b0717d8c45)	Nessus	Fedora Local Security Checks	medium
172732	Fedora 38 : flatpak (2023-508e400dec)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2023-28100

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium