SB2021101519 - openEuler update for flatpak

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021101519

SB2021101519 - openEuler update for flatpak

Published: October 15, 2021

Security Bulletin ID SB2021101519
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security features bypass (CVE-ID: CVE-2019-10063)

The vulnerability allows a malicious application to bypass implemented security restrictions.

The vulnerability exists due to improper input validation. If Flatpak runs from a terminal emulator containing an interactive shell, a malicious Flatpak app could inject input into the interactive shell by using the TIOCSTI ioctl.


2) Input validation error (CVE-ID: CVE-2017-5226)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input. The non-privileged session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.


Remediation

Install update from vendor's website.

References