Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1806-1 advisory.

    - CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1831-1 advisory.

    - CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1832-1 advisory.

    - CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1803-1 advisory.

    - CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of flatpak installed on the remote host is prior to 1.0.9-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2538 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-611 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1547-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1548-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1536-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1535-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-43ea98691e advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-c8d21fe399 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5666 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in     versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute     arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be     given a command to run in the specified Flatpak app, optionally along with some arguments. However it is     possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an     arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from     within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect     of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to     pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since     bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-     desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create     .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9,     1.12.9, and 1.14.6. (CVE-2024-32462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198139	SUSE SLES15 Security Update : xdg-desktop-portal (SUSE-SU-2024:1806-1)	Nessus	SuSE Local Security Checks	high
198133	SUSE SLES15 Security Update : xdg-desktop-portal (SUSE-SU-2024:1831-1)	Nessus	SuSE Local Security Checks	high
198132	SUSE SLES12 Security Update : xdg-desktop-portal (SUSE-SU-2024:1832-1)	Nessus	SuSE Local Security Checks	high
198053	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xdg-desktop-portal (SUSE-SU-2024:1803-1)	Nessus	SuSE Local Security Checks	high
197109	Amazon Linux 2 : flatpak (ALAS-2024-2538)	Nessus	Amazon Linux Local Security Checks	high
196916	Amazon Linux 2023 : flatpak, flatpak-devel, flatpak-libs (ALAS2023-2024-611)	Nessus	Amazon Linux Local Security Checks	high
195154	SUSE SLES15 Security Update : flatpak (SUSE-SU-2024:1547-1)	Nessus	SuSE Local Security Checks	high
195148	SUSE SLES12 Security Update : flatpak (SUSE-SU-2024:1548-1)	Nessus	SuSE Local Security Checks	high
195101	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : flatpak (SUSE-SU-2024:1536-1)	Nessus	SuSE Local Security Checks	high
195095	SUSE SLES15 Security Update : flatpak (SUSE-SU-2024:1535-1)	Nessus	SuSE Local Security Checks	high
194707	Fedora 40 : flatpak (2024-43ea98691e)	Nessus	Fedora Local Security Checks	high
193863	Fedora 39 : flatpak (2024-c8d21fe399)	Nessus	Fedora Local Security Checks	high
193600	Debian dsa-5666 : flatpak - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-32462

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high