CVE-2024-32462

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.

Security Fix(es):

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of flatpak run expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass bwrap arguments to --command=, such as --bind. It's possible to pass an arbitrary commandline to the portal interface org.freedesktop.portal.Background.RequestBackground from within a Flatpak app. When this is converted into a --command and arguments, it achieves the same effect of passing arguments directly to bwrap, and thus can be used for a sandbox escape. The solution is to pass the -- argument to bwrap, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.(CVE-2024-32462)

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of flatpak run expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass bwrap arguments to --command=, such as --bind. It's possible to pass an arbitrary commandline to the portal interface org.freedesktop.portal.Background.RequestBackground from within a Flatpak app. When this is converted into a --command and arguments, it achieves the same effect of passing arguments directly to bwrap, and thus can be used for a sandbox escape. The solution is to pass the -- argument to bwrap, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

• CVE-2024-32462: mitigate sandbox escape by passing the -- argument to bwrap

A malicious or compromised Flatpak app could execute arbitrary code outside its sandbox.

These are all security issues fixed in the flatpak-1.15.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the xdg-desktop-portal-1.18.4-1.1 package on the GA media of openSUSE Tumbleweed.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

• flatpak: sandbox escape via RequestBackground portal (CVE-2024-32462)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

This update for bubblewrap, flatpak updates flatpak to 1.16.0.

flatpak changes:

• Update to version 1.16.0:

  • Bug fixes:

    • Update libglnx to 2024-12-06:

      . Fix an assertion failure if creating a parent directory encounters a dangling symlink. . Fix a Meson warning. . Don't emit terminal progress indicator escape sequences by default. They are interpreted as notifications by some terminal emulators.

    • Fix introspection annotations in libflatpak.

  • Enhancements:

    • Add the FLATPAK_TTY_PROGRESS environment variable, which re-enables the terminal progress indicator escape sequences added in 1.15.91.
    • Document the FLATPAK_FANCY_OUTPUT environment variable, which allows disabling the fancy formatting when outputting to a terminal.

Update to version 1.15.91 (unstable):

• Enhancements:

  • Add the FLATPAK_DATA_DIR environment variable, which allows overriding at runtime the data directory location that Flatpak uses to search for configuration files such as remotes. This is useful for running tests, and for when installing using Flatpak in a chroot.
  • Add a FLATPAK_DOWNLOAD_TMPDIR variable. This allows using download directories other than /var/tmp.
  • Emit progress escape sequence. This can be used by terminal emulators to detect and display progress of Flatpak operations on their graphical user interfaces.

• Bug fixes:

  • Install missing test data. This should fix 'as-installed' tests via ginsttest-runner, used for example in Debian's autopkgtest framework.
  • Unify and improve how the Wayland socket is passed to the sandboxed app. This should fix a regression that is triggered by compositors that both implement the security-context-v1 protocol, and sets the WAYLAND_DISPLAY environment variable when launching Flatpak apps.
  • Fix the plural form of a translatable string.

Update to version 1.15.12:

• Return to using the process ID of the Flatpak app in the cgroup name. Using the instance ID in 1.15.11 caused crashes when installing apps, extensions or runtimes that use the 'extra data' mechanism, which does not set up an instance ID.

Changes from version 1.15.11:

• Dependencies:

  • In distributions that compile Flatpak to use a separate xdg-dbus-proxy executable, version 0.1.6 is recommended (but not required).
  • The minimum xdg-dbus-proxy continues to be 0.1.0.

• Enhancements:

  • Allow applications like WebKit to connect the AT-SPI accessibility tree of processes in a sub-sandbox with the tree in the main process. . New sandboxing parameter flatpak run --a11y-own-name, which is like --own-name but for the accessibility bus. . flatpak-portal API v7: add new sandbox-a11y-own-names option, which accepts names matching ${FLATPAK_ID}.* . Apps may call the org.a11y.atspi.Socket.Embedded method on names matching ${FLATPAK_ID}.Sandboxed.* by default . flatpak run -vv $app_id shows all applicable sandboxing parameters and their source, including overrides, as debug messages
  • Introduce USB device listing . Apps can list which USB devices they want to access ahead of time by using the --usb parameter. Check the manpages for the more information about the accepted syntax. . Denying access to USB devices is also possible with the --no-usb parameter. The syntax is equal to --usb. . Both options merely store metadata, and aren't used by Flatpak itself. This metadata is intended to be used by the (as of now, still in progress) USB portal to decide which devices the app can enumerate and request access.
  • Add support for KDE search completion
  • Use the instance id of the Flatpak app as part of the cgroup name. This better matches the naming…

This update for flatpak fixes the following issues:

• CVE-2024-32462: Fixed arbitrary code execution outside sandbox via malicious app due to insufficient 'command' argument sanitization (bsc#1223110)

This update for flatpak fixes the following issues:

• CVE-2024-32462: Fixed arbitrary code execution outside sandbox via malicious app due to insufficient 'command' argument sanitization (bsc#1223110)

This update for flatpak fixes the following issues:

• CVE-2024-32462: Fixed arbitrary code execution outside sandbox via malicious app due to insufficient 'command' argument sanitization (bsc#1223110)

This update for flatpak fixes the following issues:

• CVE-2024-32462: Fixed arbitrary code execution outside sandbox via malicious app due to insufficient 'command' argument sanitization (bsc#1223110)

This update for xdg-desktop-portal fixes the following issues:

• CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110).

This update for xdg-desktop-portal fixes the following issues:

• CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110).

This update for xdg-desktop-portal fixes the following issues:

• CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110).

This update for xdg-desktop-portal fixes the following issues:

• CVE-2024-32462: Fixed sandbox escape via RequestBackground portal (bsc#1223110).

This update for xdg-desktop-portal fixes the following issues:

• CVE-2024-32462: Fix arbitrary code execution outside bwrap sandbox by checking that the first commandline item doesn't start with whitespaces or a hyphen. (bsc#1223110)