Every CVE Search/ Get API key

CVE-2018-6560

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3,...

8.8 HighFix available

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.41%Down 0.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Record
CVE-2018-6560
CVSS 3.0
8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-436
Updated
2026-11-02
CVE List No score

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Record
CVE-2018-6560
Updated
2026-11-02
EUVDEUVD-2018-18311 No score

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Record
EUVD-2018-18311
Updated
2026-11-03
GitHub AdvisoriesGHSA-5xcx-r88v-8v7g 8.8

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3,...

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Record
GHSA-5xcx-r88v-8v7g
CVSS 3.0
8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-436
Updated
2026-11-02
OSV 8.8

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Record
CVE-2018-6560
CVSS 3.0
8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-6560 8.8

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Record
DEBIAN-CVE-2018-6560
CVSS 3.0
8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:2766 6.5

Red Hat Security Advisory: flatpak security update

Record
RHSA-2018:2766
CVSS 3.0
6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2018-6560 8.8

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Record
UBUNTU-CVE-2018-6560
CVSS 3.0
8.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2018-0143 No score

Updated flatpak packages fix security vulnerability

Updated flatpak packages fix security vulnerability:

A sandbox escape in the flatpak dbus proxy in the authentication phase (CVE-2018-6560).

The flatpak has been upgraded to the latest stable version, 0.10.3, which fixes this issue. The bubblewrap, ostree, flatpak-builder, xdg-desktop-portal, xdg-desktop-portal-gtk, and appstream-glib packages have also been upgraded to support this updated.

Record
MGASA-2018-0143
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flatpak
Debian:12
 before 0.10.3-1
0.10.3-1
flatpak
Debian:13
 before 0.10.3-1
0.10.3-1
flatpak
Debian:14
 before 0.10.3-1
0.10.3-1
bubblewrap
Mageia:6
 before 0.2.0-1.mga6
0.2.0-1.mga6
ostree
Mageia:6
 before 2018.1-1.mga6
2018.1-1.mga6
flatpak
Mageia:6
 before 0.10.3-1.mga6
0.10.3-1.mga6
flatpak-builder
Mageia:6
 before 0.10.6-1.mga6
0.10.6-1.mga6
xdg-desktop-portal
Mageia:6
 before 0.9-1.mga6
0.9-1.mga6
xdg-desktop-portal-gtk
Mageia:6
 before 0.9-1.mga6
0.9-1.mga6
appstream-glib
Mageia:6
 before 0.7.6-1.mga6
0.7.6-1.mga6
Show 15 moreShow less
Affected packages
PackageAffectedFixed
flatpak
Red Hat:enterprise_linux:7::client
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-libs
Red Hat:enterprise_linux:7::client
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-builder
Red Hat:enterprise_linux:7::client
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-devel
Red Hat:enterprise_linux:7::client
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak
Red Hat:enterprise_linux:7::server
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-libs
Red Hat:enterprise_linux:7::server
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-builder
Red Hat:enterprise_linux:7::server
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-devel
Red Hat:enterprise_linux:7::server
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak
Red Hat:enterprise_linux:7::workstation
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-libs
Red Hat:enterprise_linux:7::workstation
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-builder
Red Hat:enterprise_linux:7::workstation
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5
flatpak-devel
Red Hat:enterprise_linux:7::workstation
 before 0:0.8.8-4.el7_5
0:0.8.8-4.el7_5

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-6560 is a high vulnerability (CVSS 8.8) in Flatpak, published February 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in flatpak 0.10.3-1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open