Detections
Analytics

Alpine: multiple flatpak packages: security update to 1.2.4-r0

critical Tenable Cloud Security Plugin ID 404478

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass.
 Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps
 from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling
 terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was
 incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has
 TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits,
 which the Linux kernel would treat as equivalent to TIOCSTI. (CVE-2019-10063)

See Also

https://security.alpinelinux.org/vuln/CVE-2019-10063

Plugin Details

Severity: Critical

ID: 404478

Version: Revision 1.29

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 95.09

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2019-10063

CVSS v3

Risk Factor: Critical

Base Score: 9

Temporal Score: 7.8

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 3/26/2019

Reference Information

CVE: CVE-2019-10063