{"id":"CVE-2024-42472","aliases":["ALPINE-CVE-2024-42472","ALSA-2024:6356","ALSA-2024:6422","ALSA-2024:9449","CLSA-2024-1726313380","CLSA-2025-1741125454","CLSA-2025-1741291194","DEBIAN-CVE-2024-42472","DLA-4099-1","DSA-5749-1","EUVD-2024-39634","GHSA-7hgv-f2j8-xw87","MGASA-2025-0303","OESA-2024-2053","RHSA-2024:6355","RHSA-2024:6356","RHSA-2024:6357","RHSA-2024:6417","RHSA-2024:6418","RHSA-2024:6419","RHSA-2024:6420","RHSA-2024:6421","RHSA-2024:6422","RHSA-2024:9449","RLSA-2024:6356","RLSA-2024:6422","RLSA-2024:9449","SUSE-RU-2025:0145-1","SUSE-SU-2024:3073-1","SUSE-SU-2024:3104-1","SUSE-SU-2024:3174-1","UBUNTU-CVE-2024-42472","USN-7046-1","openSUSE-SU-2024:14269-1","openSUSE-SU-2024:14275-1"],"status":"published","title":"Flatpak may allow access to files outside sandbox for certain apps","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01272,"percentile":0.70069,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2024-08-14T00:00:00Z","modified":"2026-11-03T06:32:45Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"bubblewrap","fixed_in":["0.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"bubblewrap","fixed_in":["0.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"bubblewrap","fixed_in":["0.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"bubblewrap","fixed_in":["0.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"bubblewrap","fixed_in":["0.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"flatpak","fixed_in":["1.14.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"flatpak","fixed_in":["1.14.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"flatpak","fixed_in":["1.14.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"flatpak","fixed_in":["1.14.10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"flatpak","fixed_in":["1.14.10-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"bubblewrap","fixed_in":["0.4.1-7.el9_4.alma.1","0.4.1-8.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flatpak","fixed_in":["1.12.9-3.el9_4","1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flatpak-devel","fixed_in":["1.12.9-3.el9_4","1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flatpak-libs","fixed_in":["1.12.9-3.el9_4","1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flatpak-selinux","fixed_in":["1.12.9-3.el9_4","1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"flatpak-session-helper","fixed_in":["1.12.9-3.el9_4","1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"bubblewrap","fixed_in":["0.4.0-2.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"flatpak","fixed_in":["1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"flatpak-devel","fixed_in":["1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"flatpak-libs","fixed_in":["1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"flatpak-selinux","fixed_in":["1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"flatpak-session-helper","fixed_in":["1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"flatpak","fixed_in":["1.0.9-13.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"flatpak-builder","fixed_in":["1.0.0-13.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"flatpak-devel","fixed_in":["1.0.9-13.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:7","package":"flatpak-libs","fixed_in":["1.0.9-13.el7_9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"bubblewrap","fixed_in":["0.4.1-6.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak","fixed_in":["1.12.7-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-devel","fixed_in":["1.12.7-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-libs","fixed_in":["1.12.7-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-selinux","fixed_in":["1.12.7-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-session-helper","fixed_in":["1.12.7-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-tests","fixed_in":["1.12.7-2.el9.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"flatpak","fixed_in":["1.14.10-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"flatpak","fixed_in":["1.14.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"flatpak","fixed_in":["1.14.10-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"flatpak","fixed_in":["1.10.8-0+deb11u3"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"flatpak","fixed_in":["1.14.10-1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"bubblewrap","fixed_in":["0.7.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"flatpak","fixed_in":["1.10.2-9.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"flatpak","fixed_in":["1.0.3-13.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"flatpak","fixed_in":["1.10.2-9.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"flatpak","fixed_in":["1.10.2-9.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"flatpak","fixed_in":["1.10.2-9.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-debugsource","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-libs","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-selinux","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-session-helper","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"bubblewrap","fixed_in":["0:0.4.1-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.1-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.1-7.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-debuginfo","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-debugsource","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-devel","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-libs-debuginfo","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-session-helper","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-tests-debuginfo","fixed_in":["0:1.12.7-5.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debugsource","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-selinux","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap","fixed_in":["0:0.4.1-7.el9_4","0:0.4.1-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.1-7.el9_4","0:0.4.1-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.1-7.el9_4","0:0.4.1-8.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debuginfo","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debugsource","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-devel","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-libs-debuginfo","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-tests-debuginfo","fixed_in":["0:1.12.9-3.el9_4","0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-debugsource","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-libs","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-selinux","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-session-helper","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.12.5-5.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bubblewrap","fixed_in":["0:0.4.1-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.1-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.1-7.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"flatpak","fixed_in":["0:1.0.9-15.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"flatpak-debuginfo","fixed_in":["0:1.0.9-15.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"flatpak-libs","fixed_in":["0:1.0.9-15.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"flatpak-builder","fixed_in":["0:1.0.0-15.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"flatpak-devel","fixed_in":["0:1.0.9-15.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-debugsource","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-libs","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-selinux","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-session-helper","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-debugsource","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-libs","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-selinux","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-session-helper","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-debugsource","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-libs","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-selinux","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-session-helper","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.8.5-7.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-debugsource","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-libs","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-selinux","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-session-helper","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-debuginfo","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-debugsource","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-devel","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-libs-debuginfo","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-session-helper","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-tests-debuginfo","fixed_in":["0:1.10.7-4.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-debugsource","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-libs","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-selinux","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-session-helper","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.6.2-9.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-debugsource","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-libs","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-selinux","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-session-helper","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-debugsource","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-libs","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-selinux","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-session-helper","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-debugsource","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-libs","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-selinux","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-session-helper","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.8.7-4.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debuginfo","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debugsource","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs-debuginfo","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-selinux","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-tests-debuginfo","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap-debuginfo","fixed_in":["0:0.4.0-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap-debugsource","fixed_in":["0:0.4.0-2.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-debuginfo","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-debugsource","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-devel","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-libs-debuginfo","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-session-helper","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-session-helper-debuginfo","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-tests-debuginfo","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"flatpak","fixed_in":["0:1.12.9-3.el9_5"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"bubblewrap","fixed_in":["0:0.4.0-2.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"flatpak","fixed_in":["0:1.12.9-3.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"bubblewrap","fixed_in":["0:0.4.1-8.el9_5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bubblewrap","fixed_in":["0.3.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"flatpak","fixed_in":["1.4.2-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bubblewrap","fixed_in":["0.3.3-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"flatpak","fixed_in":["1.4.2-3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"bubblewrap","fixed_in":["0.8.0-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"bubblewrap","fixed_in":["0.8.0-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"flatpak","fixed_in":["1.14.5-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"flatpak","fixed_in":["1.14.6-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"bubblewrap","fixed_in":["0.8.0-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"flatpak","fixed_in":["1.14.5-150500.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"bubblewrap","fixed_in":["0.8.0-150500.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"flatpak","fixed_in":["1.14.6-150600.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"flatpak","fixed_in":["1.10.8-150200.4.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"flatpak","fixed_in":["1.10.8-150200.4.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"flatpak","fixed_in":["1.12.8-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"flatpak","fixed_in":["1.12.8-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"flatpak","fixed_in":["1.10.8-150200.4.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"flatpak","fixed_in":["1.10.8-150200.4.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"flatpak","fixed_in":["1.12.8-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"flatpak","fixed_in":["1.10.8-150200.4.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"flatpak","fixed_in":["1.10.8-150200.4.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"flatpak","fixed_in":["1.12.8-150400.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"bubblewrap","fixed_in":["0.4.1-150200.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"flatpak","fixed_in":["1.10.8-150200.4.21.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"flatpak","fixed_in":["1.6.5-0ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"flatpak","fixed_in":["1.12.7-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"flatpak","fixed_in":["1.14.6-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"bubblewrap","fixed_in":["0.4.0-1ubuntu4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bubblewrap","fixed_in":["0.6.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"bubblewrap","fixed_in":["0.9.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bubblewrap","fixed_in":["0.10.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"flatpak","fixed_in":["1.15.10-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.0"},{"fixed":"1.14.10-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-7.el9_4.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-2.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-8.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-13.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.9-13.el7_9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-6.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"flatpak-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-2.el9.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1~deb12u1"}]}],"versions":["1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-0+deb11u3"}]}],"versions":["1.10.2-3","1.10.3-0+deb11u1","1.10.3-0+deb11u1~bpo11+1","1.10.5-0+deb11u1","1.10.5-0+deb11u1~bpo10+1","1.10.7-0+deb11u1","1.10.7-0+deb11u1~bpo10+1","1.10.8-0+deb11u1","1.10.8-0+deb11u2"]},{"source":"osv","ecosystem":"Debian:12","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1~deb12u1"}]}],"versions":["1.14.4-1","1.14.4-1+deb12u1","1.14.4-1+deb12u1~bpo11+1","1.14.4-2","1.14.5-1","1.14.6-1","1.14.6-1~deb13u1","1.14.8-1","1.14.8-1~deb12u1"]},{"source":"osv","ecosystem":"Mageia:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.10-1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-9.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-13.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-9.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-9.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.2-9.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.7-5.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.5-5.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-7.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-15.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-15.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-15.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-15.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.9-15.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-7.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.7-4.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.2-9.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.7-4.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"bubblewrap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-8.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-session-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"flatpak-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el9_5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.0-2.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.12.9-3.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-8.el9_5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150500.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150500.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"wayland-protocols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150500.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"wayland-protocols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150500.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"wayland-protocols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150500.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150500.3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"wayland-protocols","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36-150500.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150500.3.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-150600.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.3-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.5-150500.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-150500.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-150600.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.4.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.4.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.4.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.4.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.4.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.4.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.8-150400.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1-150200.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.8-150200.4.21.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.7-5","0.10.0-1","0.10.0-2","0.10.1-1","0.10.2-1","0.10.2.1-1","0.10.2.1-2","0.10.3-1","0.11.1-0ubuntu1","0.11.3-2","0.11.3-3","0.11.7-0ubuntu0.1","1.0.1-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.18.04.1","1.0.8-0ubuntu0.18.04.1","1.0.9-0ubuntu0.1","1.0.9-0ubuntu0.2","1.0.9-0ubuntu0.3","1.0.9-0ubuntu0.4","1.0.9-0ubuntu0.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-0ubuntu0.5"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-1ubuntu0.1"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-1ubuntu0.1"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-1ubuntu4.1"}]}],"versions":["0.3.3-2","0.4.0-1","0.4.0-1ubuntu1","0.4.0-1ubuntu2","0.4.0-1ubuntu3","0.4.0-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-0ubuntu0.5"}]}],"versions":["1.4.3-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.5-0ubuntu0.1","1.6.5-0ubuntu0.2","1.6.5-0ubuntu0.3","1.6.5-0ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1ubuntu0.1"}]}],"versions":["0.4.1-3build1","0.5.0-1","0.6.0-1","0.6.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.7-1ubuntu0.1"}]}],"versions":["1.10.2-3","1.12.2-1","1.12.2-2","1.12.3-1","1.12.4-1","1.12.5-1","1.12.6-1","1.12.7-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-1ubuntu0.1"}]}],"versions":["0.8.0-2","0.9.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.6-1ubuntu0.1"}]}],"versions":["1.14.4-2","1.14.5-1","1.14.5-1build1","1.14.5-1build4","1.14.5-1build5","1.14.5-1build6","1.14.6-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bubblewrap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flatpak","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"flatpak","product":"flatpak"}],"references":[{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-7hgv-f2j8-xw87","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/containers/bubblewrap/commit/68e75c3091c87583c28a439b45c45627a94d622c","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/containers/bubblewrap/commit/a253257cd298892da43e15201d83f9a02c9b58b5","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/flatpak/flatpak/commit/2cdd1e1e5ae90d7c3a4b60ce2e36e4d609e44e72","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/flatpak/flatpak/commit/3caeb16c31a3ed62d744e2aaf01d684f7991051a","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/flatpak/flatpak/commit/6bd603f6836e9b38b9b937d3b78f3fbf36e7ff75","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/flatpak/flatpak/commit/7c63e53bb2af0aae9097fd2edfd6a9ba9d453e97","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/flatpak/flatpak/commit/8a18137d7e80f0575e8defabf677d81e5cc3a788","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"https://github.com/flatpak/flatpak/commit/db3a785241fda63bf53f0ec12bb519aa5210de19","tags":["x_refsource_MISC","Patch","fix","article"]},{"url":"http://www.openwall.com/lists/oss-security/2024/08/14/6","tags":["Exploit","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00025.html","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-42472","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6356","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-42472","tags":["report"]},{"url":"https://bugzilla.redhat.com/2305202","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-6356.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6422","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-6422.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9449","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-9449.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1726313380.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1741125454.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1741291194.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42472.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42472","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-42472","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0303.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33510","tags":["report"]},{"url":"https://openwall.com/lists/oss-security/2024/08/14/6","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2053","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6355","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6355.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2305202","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-42472","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6356.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6357","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6357.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6417","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6417.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6418","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6418.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6419","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6419.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6420","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6420.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:6421","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6421.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6422.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9449.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:6356","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:6422","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:9449","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2025-145/suse-ru-20250145-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188902","tags":["report"]},{"url":"https://bugzilla.suse.com/1212476","tags":["report"]},{"url":"https://bugzilla.suse.com/1216320","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42472","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243073-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229157","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243104-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243174-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-42472","tags":["report"]},{"url":"https://github.com/flatpak/flatpak/releases/tag/1.14.10","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7046-1","tags":["advisory"]},{"url":"https://launchpad.net/bugs/2077087","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-42472","title":"Flatpak may allow access to files outside sandbox for certain apps","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","status":"published","published":"2024-08-15T18:32:11.304Z","modified":"2025-04-02T22:03:10.874Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-39634","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","status":"published","published":"2024-08-15T18:32:11Z","modified":"2025-04-02T22:03:10Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T20:52:44.372321Z"}],"nvd":[{"id":"CVE-2024-42472","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","status":"published","published":"2024-08-15T19:15:19.233Z","modified":"2026-06-17T07:49:30.987Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:10:19.135392Z"}],"osv":[{"id":"ALPINE-CVE-2024-42472","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","status":"published","published":"2024-08-15T19:15:19.233Z","modified":"2026-11-03T06:32:45.536441186Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"CVE-2024-42472","title":"Flatpak may allow access to files outside sandbox for certain apps","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","status":"published","published":"2024-08-15T18:32:11.304Z","modified":"2026-10-28T10:42:02.426330589Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"DEBIAN-CVE-2024-42472","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.  When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.  However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.  Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.  For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","status":"published","published":"2024-08-15T19:15:19.233Z","modified":"2026-11-02T12:02:45.0857627Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:43.156294Z"},{"id":"OESA-2024-2053","title":"flatpak security update","description":"flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information.\n\nSecurity Fix(es):\n\nFlatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.\n\nWhen `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn\u0026apos;t have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access.\n\nHowever, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox.\n\nPartial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code.\n\nFor the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \u0026quot;wrap\u0026quot; subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.(CVE-2024-42472)","status":"published","published":"2024-08-23T11:07:31Z","modified":"2026-08-18T01:18:35.719231437Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:6355","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-09-17T01:14:29Z","modified":"2026-06-26T12:22:32.477821099Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6356","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-09-17T01:14:19Z","modified":"2026-06-26T12:22:32.461983307Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6357","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-09-17T01:14:07Z","modified":"2026-03-18T10:34:11Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6417","title":"Red Hat Security Advisory: flatpak security update","status":"published","published":"2024-09-17T01:15:15Z","modified":"2026-06-26T12:22:23.374366506Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6418","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-09-17T01:14:38Z","modified":"2026-03-18T10:34:15Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6419","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-09-17T01:14:48Z","modified":"2026-06-26T12:22:23.377165401Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6420","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-09-17T01:14:57Z","modified":"2026-03-18T10:34:16Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6421","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-09-17T01:15:25Z","modified":"2026-03-18T10:34:16Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:6422","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-09-17T01:15:06Z","modified":"2026-06-26T12:22:32.465824464Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RHSA-2024:9449","title":"Red Hat Security Advisory: bubblewrap and flatpak security update","status":"published","published":"2024-11-12T18:07:20Z","modified":"2026-06-26T12:22:33.193656212Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"RLSA-2024:6356","title":"Important: bubblewrap and flatpak security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.\n\nSecurity Fix(es):\n\n* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-05-07T19:13:05.465265Z","modified":"2025-05-07T20:08:47.893001Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:6422","title":"Important: bubblewrap and flatpak security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.\n\nSecurity Fix(es):\n\n* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-17T00:54:42.512349Z","modified":"2026-02-04T17:00:04.908456Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"RLSA-2024:9449","title":"Important: bubblewrap and flatpak security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.\n\nSecurity Fix(es):\n\n* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-11-19T16:02:19.758877Z","modified":"2025-10-09T06:18:58.11326Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.923365Z"},{"id":"UBUNTU-CVE-2024-42472","description":"Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and confidentiality. When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the command-line interface), that means that an application which otherwise doesn't have access to the real user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the scenes, this directory is actually a bind mount and the data is stored in the per-application directory as `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory to still work as intended without general home directory access. However, the application does have write access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the application is started, the bind mount will follow the symlink and mount whatever it points to into the sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two instances of a malicious app running in parallel. Closing the race condition requires updating or patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar option, then the version of bubblewrap that needs to be patched is a system copy that is distributed separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`. This configuration is the default when building from source code. For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson \"wrap\" subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it. As a workaround, avoid using applications using the `persistent` (`--persist`) permission.","status":"published","published":"2024-08-15T19:15:00Z","modified":"2026-09-10T16:30:20.564452746Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"ALSA-2024:6356","title":"Important: bubblewrap and flatpak security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.\n\nSecurity Fix(es):\n\n* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-04T00:00:00Z","modified":"2026-10-29T11:32:03.729437734Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:6422","title":"Important: bubblewrap and flatpak security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.\n\nSecurity Fix(es):\n\n* flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-09-05T00:00:00Z","modified":"2026-10-29T11:02:27.940447383Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2024:9449","title":"Important: bubblewrap and flatpak security update","description":"Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.  \n\nSecurity Fix(es):  \n\n  * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-12T00:00:00Z","modified":"2026-10-29T11:31:54.513240085Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"CLSA-2024-1726313380","title":"flatpak: Fix of CVE-2024-42472","description":"- CVE-2024-42472: access to files outside sandbox for apps using persistent\n  directories","status":"published","published":"2024-09-14T11:29:44Z","modified":"2026-06-01T00:33:05.187754755Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2025-1741125454","title":"bubblewrap: Fix of CVE-2024-42472","description":"- fix CVE-2024-42472 in flatpak by adding --bind-fd and --ro-bind-fd options in\n  in bubblewrap, enabling race-free bind mounts using an O_PATH file descriptor\n  instead of a direct path","status":"published","published":"2025-03-04T21:57:39Z","modified":"2026-06-01T00:30:29.274108912Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"CLSA-2025-1741291194","title":"flatpak: Fix of CVE-2024-42472","description":"- CVE-2024-42472: patch Flatpak to include the new --bind-fd option in\n  bubblewrap to prevent symlink attacks on persistent directories","status":"published","published":"2025-03-06T19:59:59Z","modified":"2026-06-01T00:30:32.179381165Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"DLA-4099-1","title":"flatpak - security update","status":"published","published":"2025-03-31T00:00:00Z","modified":"2026-03-09T01:20:56.872784Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5749-1","title":"flatpak - security update","status":"published","published":"2024-08-14T00:00:00Z","modified":"2026-03-09T02:09:09.074926Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2025-0303","title":"Updated flatpak \u0026 bubblewrap packages fix security vulnerability","description":"Flatpak may allow access to files outside sandbox for certain apps.\n(CVE-2024-42472).\n","status":"published","published":"2025-11-19T02:16:19Z","modified":"2026-04-16T04:41:06.11855957Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2024:14269-1","title":"bubblewrap-0.10.0-1.1 on GA media","description":"These are all security issues fixed in the bubblewrap-0.10.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-16T00:00:00Z","modified":"2026-02-04T03:09:22.332176Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14275-1","title":"flatpak-1.15.10-1.1 on GA media","description":"These are all security issues fixed in the flatpak-1.15.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-20T00:00:00Z","modified":"2026-02-04T02:20:10.701269Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-RU-2025:0145-1","title":"Recommended update for bubblewrap, flatpak, wayland-protocols","description":"\nThis update for bubblewrap, flatpak updates flatpak to 1.16.0.\n\nflatpak changes:\n\n- Update to version 1.16.0:\n\n  + Bug fixes:\n\n    - Update libglnx to 2024-12-06:\n\n      . Fix an assertion failure if creating a parent directory\n        encounters a dangling symlink.\n      . Fix a Meson warning.\n      . Don't emit terminal progress indicator escape sequences by\n        default. They are interpreted as notifications by some\n        terminal emulators.\n    - Fix introspection annotations in libflatpak.\n\n  + Enhancements:\n\n    - Add the FLATPAK_TTY_PROGRESS environment variable, which\n      re-enables the terminal progress indicator escape sequences\n      added in 1.15.91.\n    - Document the FLATPAK_FANCY_OUTPUT environment variable, which\n      allows disabling the fancy formatting when outputting to a\n      terminal.\n\nUpdate to version 1.15.91 (unstable):\n\n  + Enhancements:\n\n    - Add the FLATPAK_DATA_DIR environment variable, which allows\n      overriding at runtime the data directory location that\n      Flatpak uses to search for configuration files such as\n      remotes. This is useful for running tests, and for when\n      installing using Flatpak in a chroot.\n    - Add a FLATPAK_DOWNLOAD_TMPDIR variable. This allows using\n      download directories other than /var/tmp.\n    - Emit progress escape sequence. This can be used by terminal\n      emulators to detect and display progress of Flatpak\n      operations on their graphical user interfaces.\n\n  + Bug fixes:\n\n    - Install missing test data. This should fix 'as-installed'\n      tests via ginsttest-runner, used for example in Debian's\n      autopkgtest framework.\n    - Unify and improve how the Wayland socket is passed to the\n      sandboxed app. This should fix a regression that is triggered\n      by compositors that both implement the security-context-v1\n      protocol, and sets the WAYLAND_DISPLAY environment variable\n      when launching Flatpak apps.\n    - Fix the plural form of a translatable string.\n\nUpdate to version 1.15.12:\n\n  + Return to using the process ID of the Flatpak app in the cgroup\n    name. Using the instance ID in 1.15.11 caused crashes when\n    installing apps, extensions or runtimes that use the 'extra\n    data' mechanism, which does not set up an instance ID.\n\nChanges from version 1.15.11:\n\n  + Dependencies:\n\n    - In distributions that compile Flatpak to use a separate\n      xdg-dbus-proxy executable, version 0.1.6 is recommended (but\n      not required).\n    - The minimum xdg-dbus-proxy continues to be 0.1.0.\n\n  + Enhancements:\n\n    - Allow applications like WebKit to connect the AT-SPI\n      accessibility tree of processes in a sub-sandbox with the\n      tree in the main process.\n      . New sandboxing parameter flatpak run --a11y-own-name, which\n        is like --own-name but for the accessibility bus.\n      . flatpak-portal API v7: add new sandbox-a11y-own-names\n        option, which accepts names matching ${FLATPAK_ID}.*\n      . Apps may call the org.a11y.atspi.Socket.Embedded method on\n        names matching ${FLATPAK_ID}.Sandboxed.* by default\n      . flatpak run -vv $app_id shows all applicable sandboxing\n        parameters and their source, including overrides, as debug\n        messages\n    - Introduce USB device listing\n      . Apps can list which USB devices they want to access ahead\n        of time by using the --usb parameter. Check the manpages\n        for the more information about the accepted syntax.\n      . Denying access to USB devices is also possible with the\n        --no-usb parameter. The syntax is equal to --usb.\n      . Both options merely store metadata, and aren't used by\n        Flatpak itself. This metadata is intended to be used by the\n        (as of now, still in progress) USB portal to decide which\n        devices the app can enumerate and request access.\n    - Add support for KDE search completion\n    - Use the instance id of the Flatpak app as part of the cgroup\n      name. This better matches the naming conventions for cgroup.\n\n  + Bug fixes:\n\n    - Update libglnx to 2024-08-23\n    - fix build in environments that use -Werror=return-type, such\n      as openSUSE Tumbleweed\n    - add a fallback definition for G_PID_FORMAT with older GLib\n    - avoid warnings for g_steal_fd() with newer GLib\n    - improve compatibility of g_closefrom() backport with newer\n      GLib\n    - Update meson wrap file for xdg-dbus-proxy to version 0.1.6:\n    - compatibility with D-Bus implementations that pipeline the\n      authentication handshake, such as sd-bus and zbus\n    - compatibility with D-Bus implementations that use\n      non-consecutive serial numbers, such as godbus and zbus\n    - broadcast signals can be allowed without having to add TALK\n      permission\n    - fix memory leaks\n\n  + Internal changes:\n\n    - Better const-correctness\n    - Fix a shellcheck warning in the tests\n\n- add weak dep on p11-kit-server for certificate transfer (boo#1188902)\n- disable parental controls for now by using '-Dmalcontent=disabled', to work around\n  issues with xdg-desktop-portal\n\nUpdate to version 1.14.10:\n\n  + Dependencies: In distributions that compile Flatpak to use a\n    separate bubblewrap (bwrap) executable, either version 0.10.0,\n    version 0.6.x ≥ 0.6.3, or a version with a backport of the\n    --bind-fd option is required. These versions add a new feature\n    which is required by the security fix in this release.\n  + Security fixes: Don't follow symbolic links when mounting\n    persistent directories (--persist option). This prevents a\n    sandbox escape where a malicious or compromised app could edit\n    the symlink to point to a directory that the app should not have\n    been allowed to read or write. (bsc#1229157, CVE-2024-42472,\n    GHSA-7hgv-f2j8-xw87)\n  + Documentation: Mark the 1.12.x and 1.10.x branches as\n    end-of-life (#5352)\n  + Version 1.14.9 was not released due to an incompatibility with\n    older versions of GLib. Version 1.14.10 replaces it.\n\nUpdate to version 1.14.8:\n\n  + No changes. This release is rolling out to correct mismatching\n    submodule versions in the release tarball.\n\nUpdate to version 1.14.7:\n\n  + New features: Automatically reload D-Bus session bus\n    configuration after installing or upgrading apps, to pick up\n    any exported D-Bus services (#3342)\n  + Bug fixes:\n    - Expand the list of environment variables that Flatpak apps do\n      not inherit from the host system (#5765, #5785)\n    - Don't refuse to start apps when there is no D-Bus system bus\n      available (#5076)\n    - Don't try to repeat migration of apps whose data was migrated\n      to a new name and then deleted (#5668)\n    - Fix warnings from newer GLib versions (#5660)\n    - Always set the container environment variable (#5610)\n    - In flatpak ps, add xdg-desktop-portal-gnome to the list of\n      backends we'll use to learn which apps are running in the\n      background (#5729)\n    - Avoid leaking a temporary variable from\n      /etc/profile.d/flatpak.sh into the shell environment (#5574)\n    - Avoid undefined behaviour of signed left-shift when storing\n      object IDs in a hash table (#5738)\n    - Fix Docbook validity in documentation (#5719)\n    - Skip more tests when FUSE isn't available (#5611)\n    - Fix a misleading comment in the test for CVE-2024-32462\n      (#5779)\n  + Internal changes:\n    - Fix Github Workflows recipes\n\nUpdate to version 1.14.6:\n\n  + Security fixes:\n    - Don't allow an executable name to be misinterpreted as a\n      command-line option for bwrap(1). This prevents a sandbox\n      escape where a malicious or compromised app could ask\n      xdg-desktop-portal to generate a .desktop file with access\n      to files outside the sandbox. (CVE-2024-32462, bsc#1223110)\n  + Other bug fixes:\n    - Don't parse \u003cdeveloper\u003e\u003cname/\u003e\u003c/developer\u003e as the application\n      name (#5700)\n\nbubblewrap changes:\n\nUpdate to 0.11.0:\n\n * New --overlay, --tmp-overlay, --ro-overlay and --overlay-src\n   options allow creation of overlay mounts. This feature is not\n   available when bubblewrap is installed setuid.\n * New --level-prefix option produces output that can be parsed\n   by tools like logger --prio-prefix and\n   systemd-cat --level-prefix=1\n * bug fixes and developer visible changes\n\nUpdate to version v0.10.0:\n\n * New features: Add the --[ro-]bind-fd option, which can be used\n   to mount a filesystem represented by a file descriptor without\n   time-of-check/time-of-use attacks. This is needed when\n   resolving security issue in Flatpak.\n   (CVE-2024-42472, bsc#1229157)\n * Other changes: Fix some confusing syntax in SetupOpFlag (no\n   functional change).\n\nUpdate to v0.9.0:\n\n * Build system changed to Meson from Autotools\n * Add --argv0\n   https://github.com/containers/bubblewrap/issues/91\n * --symlink is now idempotent, meaning it succeeds if the symlink\n   already exists and already has the desired target \n * Clarify security considerations in documentation\n * Clarify documentation for --cap-add\n * Report a better error message if mount(2) fails with ENOSPC\n * Fix a double-close on error reading from --args, --seccomp or\n   --add-seccomp-fd argument\n * Improve memory allocation behaviour\n\nwayland-protocols was changed:\n\nUpdate to version 1.36:\n\n  * xdg-dialog: fix missing namespace in protocol name\n\nChanges from version 1.35:\n\n  * cursor-shape-v1: Does not advertises the list of supported cursors\n  * xdg-shell: add missing enum attribute to set_constraint_adjustment\n  * xdg-shell: recommend against drawing decorations when tiled\n  * tablet-v2: mark as stable\n  * staging: add alpha-modifier protocol\n\nUpdate to 1.36:\n\n  * Fix to the xdg dialog protocol\n  * tablet-v2 protocol is now stable\n  * alpha-modifier: new protocol\n  * Bug fix to the cursor shape documentation\n  * The xdg-shell protocol now also explicitly recommends against\n    drawing decorations outside of the window geometry when tiled\n\nUpdate to 1.34:\n\n  * xdg-dialog: new protocol\n  * xdg-toplevel-drag: new protocol\n  * Fix typo in ext-foreign-toplevel-list-v1\n  * tablet-v2: clarify that name/id events are optional\n  * linux-drm-syncobj-v1: new protocol\n  * linux-explicit-synchronization-v1: add linux-drm-syncobj note\n\nUpdate to version 1.33:\n\n  * xdg-shell: Clarify what a toplevel by default includes\n  * linux-dmabuf: sync changes from unstable to stable\n  * linux-dmabuf: require all planes to use the same modifier\n  * presentation-time: stop referring to Linux/glibc\n  * security-context-v1: Make sandbox engine names use reverse-DNS\n  * xdg-decoration: remove ambiguous wording in configure event\n  * xdg-decoration: fix configure event summary\n  * linux-dmabuf: mark as stable\n  * linux-dmabuf: add note about implicit sync\n  * security-context-v1: Document what can be done with the open\n    sockets\n  * security-context-v1: Document out of band metadata for flatpak\n\n- Use gcc11 in SLE15 in order to fix a ppc64le test that was\n  failing when built with gcc7 (boo#1216320)\n\nUpdate to version 1.32:\n\n  * ext-foreign-toplevel-list: new protocol\n  * cursor-shape-v1: new protocol\n  * security-context-v1: new protocol\n  * xdg-shell: add suspended toplevel state\n  * Apart from these new additions, this release also brings the\n    usual clarifications, cleanups and fixes.\n","status":"published","published":"2025-01-16T14:27:33Z","modified":"2026-02-04T04:03:56.423675Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2024:3073-1","title":"Security update for bubblewrap and flatpak","description":"This update for bubblewrap and flatpak fixes the following issues:\n\n- CVE-2024-42472: Fixed access to files outside sandbox for apps using persistent (bsc#1229157)\n","status":"published","published":"2024-09-02T14:13:53Z","modified":"2026-02-04T02:32:23.471512Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:3104-1","title":"Security update for bubblewrap and flatpak","description":"This update for bubblewrap and flatpak fixes the following issues:\n\n- CVE-2024-42472: Fixed access to files outside sandbox for apps using persistent (bsc#1229157)\n","status":"published","published":"2024-09-03T15:00:03Z","modified":"2026-02-04T03:49:07.534849Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:3174-1","title":"Security update for bubblewrap and flatpak","description":"This update for bubblewrap and flatpak fixes the following issues:\n\n- CVE-2024-42472: Fixed access to files outside sandbox for apps using persistent (bsc#1229157)\n","status":"published","published":"2024-09-09T10:58:39Z","modified":"2026-02-04T04:23:44.542475Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-7046-1","title":"bubblewrap, flatpak vulnerability","description":"It was discovered that Flatpak incorrectly handled certain persisted\ndirectories. An attacker could possibly use this issue to read\nand write files in locations it would not normally have access to.\nA patch was also needed to Bubblewrap in order to avoid race\nconditions caused by this fix.\n","status":"published","published":"2024-09-30T18:14:43Z","modified":"2026-04-27T17:30:52.866496Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}