CVE-2018-6560
First published: Fri Feb 02 2018(Updated: )
In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/flatpak | <0.8.9 | 0.8.9 |
| redhat/flatpak | <0.10.3 | 0.10.3 |
| Flatpak Flatpak | <0.8.9 | |
| Flatpak Flatpak | >=0.9.1<=0.9.99 | |
| Flatpak Flatpak | >=0.10.0<0.10.3 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Server Aus | =7.6 | |
| Redhat Enterprise Linux Server Eus | =7.5 | |
| Redhat Enterprise Linux Server Eus | =7.6 | |
| Redhat Enterprise Linux Server Tus | =7.6 | |
| Redhat Enterprise Linux Workstation | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-6560?
The severity of CVE-2018-6560 is high with a CVSS score of 8.8.
How can this vulnerability be exploited?
Crafted D-Bus messages to the host can be used to break out of the sandbox.
Which versions of Flatpak are affected by this vulnerability?
Flatpak versions before 0.8.9, 0.9.x, and 0.10.x before 0.10.3 are affected.
How do I fix CVE-2018-6560?
Upgrade to Flatpak version 0.8.9 or later, 0.9.x or later, or 0.10.3 or later.
Where can I find more information about CVE-2018-6560?
You can find more information about CVE-2018-6560 at the following references: [link1](https://access.redhat.com/errata/RHSA-2018:2766), [link2](https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6), [link3](https://github.com/flatpak/flatpak/releases/tag/0.10.3)
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- agent/severity
- agent/remedy
- agent/weakness
- agent/author
- agent/references
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-6560
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/flatpak
- canonical/flatpak flatpak
- version/flatpak flatpak/0.9.1
- version/flatpak flatpak/0.9.99
- version/flatpak flatpak/0.10.0
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/7.6
- canonical/redhat enterprise linux server eus
- version/redhat enterprise linux server eus/7.5
- version/redhat enterprise linux server eus/7.6
- canonical/redhat enterprise linux server tus
- version/redhat enterprise linux server tus/7.6
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/7.0
- package-manager/redhat