CVE-2017-9780: High severity suse flatpak vulnerability
In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" component, files deployed as part of the app are owned by root, so in the worst case they could be setuid root.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9780?
The severity of CVE-2017-9780 is considered medium, as it allows local attackers to exploit inappropriate file permissions.
How do I fix CVE-2017-9780?
To fix CVE-2017-9780, upgrade Flatpak to version 0.8.7 or later to ensure proper permissions are enforced.
Which versions of Flatpak are affected by CVE-2017-9780?
Flatpak versions prior to 0.8.7, specifically up to and including 0.8.6, are affected by CVE-2017-9780.
What types of file permissions are exploited in CVE-2017-9780?
CVE-2017-9780 exploits inappropriate file permissions such as setuid and world-writable.
Is CVE-2017-9780 relevant for Debian Linux?
Yes, CVE-2017-9780 affects Debian 9.0 if using the vulnerable version of Flatpak.