Every CVE Search/ Get API key

CVE-2021-41133

Sandbox bypass via recent VFS-manipulating syscalls

8.8 HighFix available

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.44%Down 1.6 points since Oct 9, 2021
90%50%10%1%

What each source reports

CVE List Score used 8.8

Sandbox bypass via recent VFS-manipulating syscalls

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Record
CVE-2021-41133
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2021-28254 8.8

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Record
EUVD-2021-28254
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
NVD 8.8

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Record
CVE-2021-41133
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
OSVALPINE-CVE-2021-41133 7.8

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Record
ALPINE-CVE-2021-41133
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 7.8

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Record
CVE-2021-41133
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-41133 7.8

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Record
DEBIAN-CVE-2021-41133
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 17 moreShow less
OSVOESA-2021-1404 7.8

flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux.

Security Fix(es):

In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.(CVE-2021-41133)

Record
OESA-2021-1404
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4042 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2021:4042
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4044 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2021:4044
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4106 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2021:4106
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:4107 8.8

Red Hat Security Advisory: flatpak security update

Record
RHSA-2021:4107
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:4042 8.8

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2021:4042
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-41133 7.8

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process. They can do this by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely. Flatpak apps that act as clients for AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can escalate the privileges that the corresponding services will believe the Flatpak app has. Note that protocols that operate entirely over the D-Bus session bus (user bus), system bus or accessibility bus are not affected by this. This is due to the use of a proxy process xdg-dbus-proxy, whose VFS cannot be manipulated by the Flatpak app, when interacting with these buses. Patches exist for versions 1.10.4 and 1.12.0, and as of time of publication, a patch for version 1.8.2 is being planned. There are no workarounds aside from upgrading to a patched version.

Record
UBUNTU-CVE-2021-41133
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
8.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALEA-2021:4539 No score

flatpak bug fix and enhancement update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Bug Fix(es) and Enhancement(s):

  • CVE-2021-41133 flatpak: sandbox bypass via recent VFS-manipulating syscalls (BZ#2012868)
Record
ALEA-2021:4539
Updated
2026-11-02
OSVALSA-2021:4042 No score

Important: flatpak security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

  • flatpak: Sandbox bypass via recent VFS-manipulating syscalls (CVE-2021-41133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2021:4042
Updated
2026-11-02
OSVMGASA-2021-0486 No score

Updated flatpak packages fix security vulnerability

Flatpak apps with direct access to AF_UNIX sockets such as those used by Wayland, Pipewire or pipewire-pulse can trick portals and other host-OS services into treating the Flatpak app as though it was an ordinary, non-sandboxed host-OS process, by manipulating the VFS using recent mount-related syscalls that are not blocked by Flatpak's denylist seccomp filter, in order to substitute a crafted /.flatpak-info or make that file disappear entirely.

Record
MGASA-2021-0486
Updated
2026-11-02
OSVopenSUSE-SU-2021:1400-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • Update to version 1.10.5:
  • CVE-2021-41133: Fixed a bug that could lead to sandbox bypass via recent VFS-manipulating syscalls. (bsc#1191507)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2021:1400-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:3472-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • Update to version 1.10.5:
  • CVE-2021-41133: Fixed a bug that could lead to sandbox bypass via recent VFS-manipulating syscalls. (bsc#1191507)
Record
openSUSE-SU-2021:3472-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11574-1 No score

flatpak-1.12.1-1.1 on GA media

These are all security issues fixed in the flatpak-1.12.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11574-1
Updated
2026-11-02
OSVSUSE-SU-2021:3472-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • Update to version 1.10.5:
  • CVE-2021-41133: Fixed a bug that could lead to sandbox bypass via recent VFS-manipulating syscalls. (bsc#1191507)
Record
SUSE-SU-2021:3472-1
Updated
2026-11-02
OSVSUSE-SU-2022:3284-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2021-41133: Fixed sandbox bypass via recent syscalls (bsc#1191507).
  • CVE-2021-43860: Fixed metadata validation (bsc#1194610).
Record
SUSE-SU-2022:3284-1
Updated
2026-11-02
OSVSUSE-SU-2022:3439-1 No score

Security update for flatpak

This update for flatpak fixes the following issues:

  • CVE-2021-41133: Fixed sandbox bypass via recent syscalls (bsc#1191507).
Record
SUSE-SU-2022:3439-1
Updated
2026-11-02
OSVUSN-5191-1 No score

flatpak vulnerability

It was discovered that Flatpak incorrectly handled certain AF_UNIX sockets. An attacker could use this to specially craft a Flatpak application that could escape sandbox confinement.

Record
USN-5191-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
AlmaLinux:8
 before 1.8.5-5.el8_5
1.8.5-5.el8_5
flatpak-devel
AlmaLinux:8
 before 1.8.5-5.el8_5
1.8.5-5.el8_5
flatpak-libs
AlmaLinux:8
 before 1.8.5-5.el8_5
1.8.5-5.el8_5
flatpak-selinux
AlmaLinux:8
 before 1.8.5-5.el8_5
1.8.5-5.el8_5
flatpak-session-helper
AlmaLinux:8
 before 1.8.5-5.el8_5
1.8.5-5.el8_5
flatpak
Alpine:v3.14
 1.10.0 up to 1.10.5-r0
1.10.5-r0
flatpak
Alpine:v3.15
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
Alpine:v3.16
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
Alpine:v3.17
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
Alpine:v3.18
 1.10.0 up to 1.12.2-r0
1.12.2-r0
Show 79 moreShow less
Affected packages
PackageAffectedFixed
flatpak
Alpine:v3.19
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
Alpine:v3.20
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
Alpine:v3.21
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
Alpine:v3.22
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
Alpine:v3.23
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
Alpine:v3.24
 1.10.0 up to 1.12.2-r0
1.12.2-r0
flatpak
AlmaLinux:8
 before 1.8.5-4.el8_4
1.8.5-4.el8_4
flatpak-libs
AlmaLinux:8
 before 1.8.5-4.el8_4
1.8.5-4.el8_4
flatpak-selinux
AlmaLinux:8
 before 1.8.5-4.el8_4
1.8.5-4.el8_4
flatpak-session-helper
AlmaLinux:8
 before 1.8.5-4.el8_4
1.8.5-4.el8_4
flatpak
Debian:12
 before 1.12.1-1
1.12.1-1
flatpak
Debian:13
 before 1.12.1-1
1.12.1-1
flatpak
Debian:14
 before 1.12.1-1
1.12.1-1
flatpak
Debian:11
 before 1.10.5-0+deb11u1, plus listed versions
1.10.2-31.10.3-0+deb11u11.10.3-0+deb11u1~bpo11+11.10.5-0+deb11u1~bpo10+1
1.10.5-0+deb11u1
flatpak
Mageia:8
 before 1.10.5-1.mga8
1.10.5-1.mga8
flatpak
openEuler:20.03-LTS-SP1
 before 1.0.3-7.oe1
1.0.3-7.oe1
flatpak
openEuler:20.03-LTS-SP2
 before 1.0.3-7.oe1
1.0.3-7.oe1
flatpak
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak-libs
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak-selinux
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak-session-helper
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak-session-helper-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak-tests-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak
Red Hat:enterprise_linux:7::client
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-libs
Red Hat:enterprise_linux:7::client
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-builder
Red Hat:enterprise_linux:7::client
 before 0:1.0.0-12.el7_9
0:1.0.0-12.el7_9
flatpak-devel
Red Hat:enterprise_linux:7::client
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-builder
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.0-12.el7_9
0:1.0.0-12.el7_9
flatpak-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-devel
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-libs
Red Hat:enterprise_linux:7::computenode
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak
Red Hat:enterprise_linux:7::server
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-libs
Red Hat:enterprise_linux:7::server
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-builder
Red Hat:enterprise_linux:7::server
 before 0:1.0.0-12.el7_9
0:1.0.0-12.el7_9
flatpak-devel
Red Hat:enterprise_linux:7::server
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-libs
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak-builder
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.0-12.el7_9
0:1.0.0-12.el7_9
flatpak-devel
Red Hat:enterprise_linux:7::workstation
 before 0:1.0.9-12.el7_9
0:1.0.9-12.el7_9
flatpak
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-5.el8_1
0:1.0.9-5.el8_1
flatpak-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-5.el8_1
0:1.0.9-5.el8_1
flatpak-debugsource
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-5.el8_1
0:1.0.9-5.el8_1
flatpak-libs
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-5.el8_1
0:1.0.9-5.el8_1
flatpak-libs-debuginfo
Red Hat:rhel_eus:8.1::appstream
 before 0:1.0.9-5.el8_1
0:1.0.9-5.el8_1
flatpak
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak-debugsource
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak-libs
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak-libs-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak-selinux
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak-session-helper
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak-session-helper-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak-tests-debuginfo
Red Hat:rhel_eus:8.2::appstream
 before 0:1.6.2-6.el8_2
0:1.6.2-6.el8_2
flatpak
Rocky Linux:8
 before 0:1.8.5-4.el8_4
0:1.8.5-4.el8_4
flatpak
Rocky Linux:8
 before 0:1.8.5-4.el8
0:1.8.5-4.el8
flatpak
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
 before 1.10.5-4.9.1
1.10.5-4.9.1
flatpak
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
 before 1.10.5-4.9.1
1.10.5-4.9.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise Server 15 SP1-BCL
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise Server 15 SP1-LTSS
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Enterprise Storage 6
From an advisory covering 3 CVEs
 before 1.2.3-150100.4.8.1
1.2.3-150100.4.8.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 0.10.4-150000.4.13.1
0.10.4-150000.4.13.1
flatpak
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 0.10.4-150000.4.13.1
0.10.4-150000.4.13.1
flatpak
SUSE:Linux Enterprise Server 15-LTSS
 before 0.10.4-150000.4.13.1
0.10.4-150000.4.13.1
flatpak
SUSE:Linux Enterprise Server for SAP Applications 15
 before 0.10.4-150000.4.13.1
0.10.4-150000.4.13.1
flatpak
Ubuntu:18.04:LTS
 before 1.0.9-0ubuntu0.4, plus listed versions
0.8.7-50.10.0-10.10.0-20.10.1-10.10.2-1
Show 14 moreShow less
0.10.2.1-10.10.2.1-20.10.3-10.11.1-0ubuntu10.11.3-20.11.3-30.11.7-0ubuntu0.11.0.1-0ubuntu0.11.0.6-0ubuntu0.11.0.7-0ubuntu0.18.04.11.0.8-0ubuntu0.18.04.11.0.9-0ubuntu0.11.0.9-0ubuntu0.21.0.9-0ubuntu0.3
1.0.9-0ubuntu0.4
flatpak
Ubuntu:20.04:LTS
 before 1.6.5-0ubuntu0.4, plus listed versions
1.4.3-11.6.0-11.6.1-11.6.2-11.6.3-11.6.5-0ubuntu0.11.6.5-0ubuntu0.21.6.5-0ubuntu0.3
1.6.5-0ubuntu0.4
flatpak
openSUSE:Leap 15.2
 before 1.10.5-lp152.3.9.1
1.10.5-lp152.3.9.1
flatpak
openSUSE:Leap 15.3
 before 1.10.5-4.9.1
1.10.5-4.9.1
flatpak
openSUSE:Tumbleweed
 before 1.12.1-1.1
1.12.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-41133 is a high vulnerability (CVSS 8.8) in Debian Linux, published October 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in flatpak 1.8.5-5.el8_5.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open