Every CVE Search/ Get API key

CVE-2019-10063

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox...

9.0 CriticalFix available

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.91%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.0

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Record
CVE-2019-10063
CVSS 3.0
9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Record
CVE-2019-10063
Updated
2026-11-02
EUVDEUVD-2019-2124 No score

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Record
EUVD-2019-2124
Updated
2026-11-03
GitHub AdvisoriesGHSA-mc9j-733x-89cx 9.0

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox...

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Record
GHSA-mc9j-733x-89cx
CVSS 3.0
9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 9.0

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Record
CVE-2019-10063
CVSS 3.0
9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-10063 9.0

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Record
DEBIAN-CVE-2019-10063
CVSS 3.0
9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2021-1380 8.8

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.(CVE-2019-10063)

Record
OESA-2021-1380
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1024 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2019:1024
CVSS 3.0
8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1143 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2019:1143
CVSS 3.0
8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-10063 9.0

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Record
UBUNTU-CVE-2019-10063
CVSS 3.0
9.0 CriticalCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:10762-1 No score

flatpak-1.11.3-1.2 on GA media

These are all security issues fixed in the flatpak-1.11.3-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10762-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
Debian:12
 before 1.2.3-2
1.2.3-2
flatpak
Debian:13
 before 1.2.3-2
1.2.3-2
flatpak
Debian:14
 before 1.2.3-2
1.2.3-2
flatpak
openEuler:20.03-LTS-SP1
 before 1.0.3-6.oe1
1.0.3-6.oe1
flatpak
openEuler:20.03-LTS-SP2
 before 1.0.3-6.oe1
1.0.3-6.oe1
flatpak
Red Hat:enterprise_linux:7::client
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-libs
Red Hat:enterprise_linux:7::client
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-builder
Red Hat:enterprise_linux:7::client
 before 0:1.0.0-5.el7_6
0:1.0.0-5.el7_6
flatpak-devel
Red Hat:enterprise_linux:7::client
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
Show 22 moreShow less
Affected packages
PackageAffectedFixed
flatpak
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-builder
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.0-5.el7_6
0:1.0.0-5.el7_6
flatpak-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-libs
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak
Red Hat:enterprise_linux:7::server
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-libs
Red Hat:enterprise_linux:7::server
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-builder
Red Hat:enterprise_linux:7::server
 before 0:1.0.0-5.el7_6
0:1.0.0-5.el7_6
flatpak-devel
Red Hat:enterprise_linux:7::server
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-libs
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak-builder
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.0-5.el7_6
0:1.0.0-5.el7_6
flatpak-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.2-5.el7_6
0:1.0.2-5.el7_6
flatpak
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.6-3.el8_0
0:1.0.6-3.el8_0
flatpak-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.6-3.el8_0
0:1.0.6-3.el8_0
flatpak-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.6-3.el8_0
0:1.0.6-3.el8_0
flatpak-libs
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.6-3.el8_0
0:1.0.6-3.el8_0
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.6-3.el8_0
0:1.0.6-3.el8_0
flatpak
Ubuntu:18.04:LTS
 before 1.0.8-0ubuntu0.18.04.1, plus listed versions
0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1
Show 10 moreShow less
0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.1
1.0.8-0ubuntu0.18.04.1
flatpak
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.11.3-1.2
1.11.3-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-10063 is a critical vulnerability (CVSS 9.0) in Flatpak, published March 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in flatpak 1.2.3-2.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open