{"id":"CVE-2019-8308","aliases":["DEBIAN-CVE-2019-8308","DSA-4390-1","EUVD-2019-17706","GHSA-26wh-22xw-qfqx","OESA-2021-1149","RHSA-2019:0375","SUSE-SU-2019:2185-1","UBUNTU-CVE-2019-8308","openSUSE-SU-2019:2038-1"],"status":"published","title":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script...","description":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.","severity":{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00466,"percentile":0.40572,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-668"],"published":"2019-02-12T00:00:00Z","modified":"2026-10-20T10:51:43Z","fixes":[{"ecosystem":"Debian:12","package":"flatpak","fixed_in":["1.2.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.2.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.2.3-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"flatpak","fixed_in":["0.8.9-0+deb9u2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-debuginfo","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-libs","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-builder","fixed_in":["0:1.0.0-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-devel","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-builder","fixed_in":["0:1.0.0-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-debuginfo","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-devel","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-libs","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-debuginfo","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-libs","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-builder","fixed_in":["0:1.0.0-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-devel","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-debuginfo","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-libs","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-builder","fixed_in":["0:1.0.0-4.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-devel","fixed_in":["0:1.0.2-4.el7_6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"flatpak","fixed_in":["1.0.7-0ubuntu0.18.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.9-0+deb9u2"}]}],"versions":["0.8.5-2","0.8.5-2+deb9u1","0.8.5-2+deb9u1~bpo8+1","0.8.6-1","0.8.7-1","0.8.7-2","0.8.7-2~deb9u1","0.8.7-2~deb9u1~bpo8+1","0.8.7-3","0.8.7-4","0.8.7-5","0.8.8-0+deb9u1","0.8.8-0+deb9u1~bpo8+1","0.8.9-0+deb9u1","0.8.9-0+deb9u1~bpo8+1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-5.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-4.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-4.el7_6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-4.10.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-0ubuntu0.18.04.1"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.4-lp150.8.1"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"flatpak","product":"flatpak"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922059","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","report"]},{"url":"https://github.com/flatpak/flatpak/releases/tag/1.2.3","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/flatpak/flatpak/releases/tag/1.0.7","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0375","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00088.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8308","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-26wh-22xw-qfqx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-8308","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21381","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1675070","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0375.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-8308","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-8308","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192185-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125431","tags":["report"]},{"url":"https://bugzilla.suse.com/1133041","tags":["report"]},{"url":"https://bugzilla.suse.com/1133043","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8308","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-8308","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/63JAJFCHSTH4KUI7632AH6V6T6Q3EXJ2/#63JAJFCHSTH4KUI7632AH6V6T6Q3EXJ2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-8308","description":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.","status":"published","published":"2019-02-12T23:00:00Z","modified":"2024-08-04T21:17:30.551Z","updated_at":"2026-11-02T14:20:22.019351Z"}],"euvd":[{"id":"EUVD-2019-17706","description":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.","status":"published","published":"2019-02-12T23:00:00Z","modified":"2024-08-04T21:17:30Z","updated_at":"2026-11-03T03:06:42.975045Z"}],"ghsa":[{"id":"GHSA-26wh-22xw-qfqx","title":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script...","description":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.","status":"published","published":"2022-05-13T01:22:56Z","modified":"2023-02-01T05:07:13Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:50:30.001937Z"}],"nvd":[{"id":"CVE-2019-8308","description":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.","status":"published","published":"2019-02-12T23:29:00.317Z","modified":"2026-06-17T02:41:49.46Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"CVE-2019-8308","description":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.","status":"published","published":"2019-02-12T23:29:00.317Z","modified":"2026-10-20T10:51:43.283458639Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-8308","description":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.","status":"published","published":"2019-02-12T23:29:00.317Z","modified":"2026-09-21T07:03:23.915693041Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"OESA-2021-1149","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\r\n\r\nSecurity Fix(es):\r\n\r\nFlatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.(CVE-2019-8308)\r\n\r\nFlatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the \u0026quot;file forwarding\u0026quot; feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app\u0026apos;s permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app\u0026apos;s .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit \u0026quot;`Disallow @@ and @@U usage in desktop files`\u0026quot;. The follow-up commits \u0026quot;`dir: Reserve the whole @@ prefix`\u0026quot; and \u0026quot;`dir: Refuse to export .desktop files with suspicious uses of @@ tokens`\u0026quot; are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` (typically `~/.local/share/flatpak/exports/share/applications/*.desktop` and `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow `@@` or `@@u`.(CVE-2021-21381)","status":"published","published":"2021-05-06T11:04:23Z","modified":"2026-08-18T01:15:28.557342031Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2019:0375","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2024-09-16T02:10:52Z","modified":"2026-06-26T12:22:02.665215037Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2019-8308","description":"Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.","status":"published","published":"2019-02-12T23:29:00Z","modified":"2026-04-22T12:21:44.42042Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.741399Z"},{"id":"DSA-4390-1","title":"flatpak - security update","status":"published","published":"2019-02-12T00:00:00Z","modified":"2026-03-09T02:10:30.929489Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:2038-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-8308: Fixed a potential sandbox escape via /proc (bsc#1125431).\n- CVE-2019-11460: Fixed a compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl (bsc#1133043).\n- CVE-2019-11461: Fixed a compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl (bsc#1133041).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-08-31T18:20:21Z","modified":"2026-02-04T02:13:56.340634Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"SUSE-SU-2019:2185-1","title":"Security update for flatpak","description":"This update for flatpak fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-8308: Fixed a potential sandbox escape via /proc (bsc#1125431).\n- CVE-2019-11460: Fixed a compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl (bsc#1133043).\n- CVE-2019-11461: Fixed a compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl (bsc#1133041).\n","status":"published","published":"2019-08-20T15:06:10Z","modified":"2026-02-04T03:35:11.498871Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}