Every CVE Search/ Get API key

CVE-2021-21381

Sandbox escape via special tokens in .desktop file

7.1 HighFix available

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "Disallow @@ and @@U usage in desktop files". The follow-up commits "dir: Reserve the whole @@ prefix" and "dir: Refuse to export .desktop files with suspicious uses of @@ tokens" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
High
Availability
None

Exploit likelihood

1.55%Down 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.1

Sandbox escape via special tokens in .desktop file

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "Disallow @@ and @@U usage in desktop files". The follow-up commits "dir: Reserve the whole @@ prefix" and "dir: Refuse to export .desktop files with suspicious uses of @@ tokens" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.

Record
CVE-2021-21381
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Weakness
CWE-74
Updated
2026-11-02
EUVDEUVD-2021-8687 7.1

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "Disallow @@ and @@U usage in desktop files". The follow-up commits "dir: Reserve the whole @@ prefix" and "dir: Refuse to export .desktop files with suspicious uses of @@ tokens" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.

Record
EUVD-2021-8687
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Updated
2026-11-03
NVD 7.1

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "Disallow @@ and @@U usage in desktop files". The follow-up commits "dir: Reserve the whole @@ prefix" and "dir: Refuse to export .desktop files with suspicious uses of @@ tokens" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.

Record
CVE-2021-21381
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 2.0
5.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:N
Weakness
CWE-74
Updated
2026-11-02
OSV 8.2

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "Disallow @@ and @@U usage in desktop files". The follow-up commits "dir: Reserve the whole @@ prefix" and "dir: Refuse to export .desktop files with suspicious uses of @@ tokens" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.

Record
CVE-2021-21381
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-21381 8.2

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "Disallow @@ and @@U usage in desktop files". The follow-up commits "dir: Reserve the whole @@ prefix" and "dir: Refuse to export .desktop files with suspicious uses of @@ tokens" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.

Record
DEBIAN-CVE-2021-21381
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2021-1149 8.2

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.(CVE-2019-8308)

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "Disallow @@ and @@U usage in desktop files". The follow-up commits "dir: Reserve the whole @@ prefix" and "dir: Refuse to export .desktop files with suspicious uses of @@ tokens" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.(CVE-2021-21381)

Record
OESA-2021-1149
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVRHSA-2021:1002 8.1

Red Hat Security Advisory: flatpak security update

Record
RHSA-2021:1002
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2021:1068 8.1

Red Hat Security Advisory: flatpak security update

Record
RHSA-2021:1068
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2021:1073 8.1

Red Hat Security Advisory: flatpak security update

Record
RHSA-2021:1073
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2021:1074 8.1

Red Hat Security Advisory: flatpak security update

Record
RHSA-2021:1074
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-21381 8.2

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens @@ and/or @@u in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "Disallow @@ and @@U usage in desktop files". The follow-up commits "dir: Reserve the whole @@ prefix" and "dir: Refuse to export .desktop files with suspicious uses of @@ tokens" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported .desktop files in exports/share/applications/*.desktop (typically ~/.local/share/flatpak/exports/share/applications/*.desktop and /var/lib/flatpak/exports/share/applications/*.desktop) to make sure that literal filenames do not follow @@ or @@u.

Record
UBUNTU-CVE-2021-21381
CVSS 3.1
8.2 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Updated
2026-11-02
OSVMGASA-2021-0143 No score

Updated flatpak packages fix security vulnerabilities

Sandbox escape where a malicious application can execute code outside the sandbox by controlling the environment of the "flatpak run" command when spawning a sub-sandbox (CVE-2021-21261).

A potential attack where a flatpak application could use custom formatted .desktop files to gain access to files on the host system (CVE-2021-21381).

The update also removes the unnecessary flatpak-tests subpackage.

Record
MGASA-2021-0143
Updated
2026-11-02
OSVMGASA-2021-0145 No score

Updated flatpak packages fix a security vulnerability

A potential attack where a flatpak application could use custom formatted .desktop files to gain access to files on the host system (CVE-2021-21381).

Record
MGASA-2021-0145
Updated
2026-11-02
OSVSUSE-SU-2022:2990-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2021-21381: Fixed an issue where a sandboxed application could read and write arbitrary host files via special tokens in the .desktop file (bsc#1183459).
  • CVE-2021-21261: Fixed a sandbox escape issue via the flatpak-portal service (bsc#1180996).

Non-security fixes:

  • openh264 extension needs to use 'extra_data'. (bsc#1155688) The update will provide the support for extra_data' in extensions and will provide a list of versions that are supported. This will be useful for the extra_data for extensions because that will require it to say that it is supported for version > 1.2.5 in the 1.2 series and > 1.4.2 otherwise. The update will includes fixes for a segfault in the function that lists the installed references (flatpak_installation_list_installed_refs). When an appstream update is cancelled while downloading icons, the update will show a proper fail. Before this fix the next update attempt will see an up-to-date timestamp, think everyhing is ok and not download the missing icons. The update will introduce checks in the OCI (Open Container Initiative format) updates for validating if it is gpg verified. The update will install the required runtime for the installed extension. The update will prevent a crash if the 'FlatpakDir' can't ensure it has a repo configured. The update will prevent the removal of local extensions considered remote and not locally related.
Record
SUSE-SU-2022:2990-1
Updated
2026-11-02
OSVUSN-4951-1 No score

flatpak vulnerability

Anton Lydike discovered that Flatpak did not properly handle special tokens in desktop files. An attacker could use this to specially craft a Flatpak application that could escape sandbox confinement.

Record
USN-4951-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
Debian:12
 before 1.10.1-4
1.10.1-4
flatpak
Debian:13
 before 1.10.1-4
1.10.1-4
flatpak
Debian:14
 before 1.10.1-4
1.10.1-4
flatpak
Debian:10
 before 1.2.5-0+deb10u4, plus listed versions
1.2.4-11.2.5-0+deb10u11.2.5-0+deb10u1~bpo9+11.2.5-0+deb10u21.2.5-0+deb10u3
1.2.5-0+deb10u4
libglib-testing
Mageia:7
From an advisory covering 2 CVEs
 before 0.1.0-2.mga7
0.1.0-2.mga7
appstream-glib
Mageia:7
From an advisory covering 2 CVEs
 before 0.7.15-1.mga7
0.7.15-1.mga7
malcontent
Mageia:7
From an advisory covering 2 CVEs
 before 0.9.0-2.mga7
0.9.0-2.mga7
bubblewrap
Mageia:7
From an advisory covering 2 CVEs
 before 0.4.1-1.mga7
0.4.1-1.mga7
ostree
Mageia:7
From an advisory covering 2 CVEs
 before 2020.8-1.mga7
2020.8-1.mga7
flatpak
Mageia:7
From an advisory covering 2 CVEs
 before 1.10.2-1.mga7
1.10.2-1.mga7
Show 54 moreShow less
Affected packages
PackageAffectedFixed
gnome-software
Mageia:7
From an advisory covering 2 CVEs
 before 3.32.2-2.1.mga7
3.32.2-2.1.mga7
flatpak
Mageia:8
 before 1.10.2-1.mga8
1.10.2-1.mga8
flatpak
openEuler:20.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.0.3-5.oe1
1.0.3-5.oe1
flatpak
Red Hat:enterprise_linux:7::client
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-libs
Red Hat:enterprise_linux:7::client
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-builder
Red Hat:enterprise_linux:7::client
 before 0:1.0.0-11.el7_9
0:1.0.0-11.el7_9
flatpak-devel
Red Hat:enterprise_linux:7::client
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-builder
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.0-11.el7_9
0:1.0.0-11.el7_9
flatpak-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-libs
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak
Red Hat:enterprise_linux:7::server
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-libs
Red Hat:enterprise_linux:7::server
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-builder
Red Hat:enterprise_linux:7::server
 before 0:1.0.0-11.el7_9
0:1.0.0-11.el7_9
flatpak-devel
Red Hat:enterprise_linux:7::server
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-libs
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak-builder
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.0-11.el7_9
0:1.0.0-11.el7_9
flatpak-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.9-11.el7_9
0:1.0.9-11.el7_9
flatpak
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak-libs
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak-selinux
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak-session-helper
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.2-6.el8_3
0:1.6.2-6.el8_3
flatpak
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak-debugsource
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak-libs
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak-libs-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak-selinux
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak-session-helper
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak-session-helper-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak-tests-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-5.el8_2
0:1.6.2-5.el8_2
flatpak
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-4.el8_1
0:1.0.9-4.el8_1
flatpak-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-4.el8_1
0:1.0.9-4.el8_1
flatpak-debugsource
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-4.el8_1
0:1.0.9-4.el8_1
flatpak-libs
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-4.el8_1
0:1.0.9-4.el8_1
flatpak-libs-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-4.el8_1
0:1.0.9-4.el8_1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 2 CVEs
 before 1.2.3-150100.4.5.2
1.2.3-150100.4.5.2
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 1.2.3-150100.4.5.2
1.2.3-150100.4.5.2
flatpak
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 2 CVEs
 before 1.2.3-150100.4.5.2
1.2.3-150100.4.5.2
flatpak
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 2 CVEs
 before 1.2.3-150100.4.5.2
1.2.3-150100.4.5.2
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 2 CVEs
 before 1.2.3-150100.4.5.2
1.2.3-150100.4.5.2
flatpak
SUSE:Enterprise Storage 6
From an advisory covering 2 CVEs
 before 1.2.3-150100.4.5.2
1.2.3-150100.4.5.2
flatpak
Ubuntu:18.04:LTS
 before 1.0.9-0ubuntu0.3, plus listed versions
0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1
Show 13 moreShow less
0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.2
1.0.9-0ubuntu0.3
flatpak
Ubuntu:20.04:LTS
 before 1.6.5-0ubuntu0.3, plus listed versions
1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-11.6.5-0ubuntu0.11.6.5-0ubuntu0.2
1.6.5-0ubuntu0.3

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21381 is a high vulnerability (CVSS 7.1) in Debian Linux, published March 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in flatpak 1.10.1-4.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open