SUSE update for flatpak
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2023-28100 CVE-2023-28101 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP3 LTSS Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP2 LTSS Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing LTSS 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing ESPOS 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system libflatpak0-debuginfo Operating systems & Components / Operating system package or component flatpak-zsh-completion Operating systems & Components / Operating system package or component flatpak-debugsource Operating systems & Components / Operating system package or component flatpak-debuginfo Operating systems & Components / Operating system package or component system-user-flatpak Operating systems & Components / Operating system package or component typelib-1_0-Flatpak-1_0 Operating systems & Components / Operating system package or component flatpak Operating systems & Components / Operating system package or component flatpak-devel Operating systems & Components / Operating system package or component libflatpak0 Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU73835
Risk: Low
CVSSv4.0: 3.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-28100
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a malicious application to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input when handling copy/paste operations. If a Flatpak app is run on a Linux virtual console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command buffer, from which the command might be run after the Flatpak app has exited.
MitigationUpdate the affected package flatpak to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications 15: SP2 - SP3
SUSE Linux Enterprise Server 15 SP3 LTSS: 15-SP3
SUSE Linux Enterprise Server 15: SP2 - SP3
SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise Real Time 15: SP3
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP3
SUSE Linux Enterprise High Performance Computing 15: SP2 - SP3
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2
SUSE Enterprise Storage: 7.1
libflatpak0-debuginfo: before 1.10.8-150200.4.15.1
flatpak-zsh-completion: before 1.10.8-150200.4.15.1
flatpak-debugsource: before 1.10.8-150200.4.15.1
flatpak-debuginfo: before 1.10.8-150200.4.15.1
system-user-flatpak: before 1.10.8-150200.4.15.1
typelib-1_0-Flatpak-1_0: before 1.10.8-150200.4.15.1
flatpak: before 1.10.8-150200.4.15.1
flatpak-devel: before 1.10.8-150200.4.15.1
libflatpak0: before 1.10.8-150200.4.15.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3_ltss:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libflatpak0-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:system-user-flatpak:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-flatpak-1_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libflatpak0:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20231714-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU73834
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-28101
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to insufficient validation of user-supplied input when displaying permissions and metadata. A remote attacker can create a specially crafted app that manipulates the appearance of the permissions list through metadata, convincing the user into granting to the app more permissions than agreed by the user.
Update the affected package flatpak to the latest version.
Vulnerable software versionsSUSE Linux Enterprise Server for SAP Applications 15: SP2 - SP3
SUSE Linux Enterprise Server 15 SP3 LTSS: 15-SP3
SUSE Linux Enterprise Server 15: SP2 - SP3
SUSE Linux Enterprise Server 15 SP2 LTSS: 15-SP2
SUSE Linux Enterprise Real Time 15: SP3
SUSE Linux Enterprise High Performance Computing LTSS 15: SP3
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP3
SUSE Linux Enterprise High Performance Computing 15: SP2 - SP3
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS: 15-SP2
SUSE Enterprise Storage: 7.1
libflatpak0-debuginfo: before 1.10.8-150200.4.15.1
flatpak-zsh-completion: before 1.10.8-150200.4.15.1
flatpak-debugsource: before 1.10.8-150200.4.15.1
flatpak-debuginfo: before 1.10.8-150200.4.15.1
system-user-flatpak: before 1.10.8-150200.4.15.1
typelib-1_0-Flatpak-1_0: before 1.10.8-150200.4.15.1
flatpak: before 1.10.8-150200.4.15.1
flatpak-devel: before 1.10.8-150200.4.15.1
libflatpak0: before 1.10.8-150200.4.15.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3_ltss:15-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15_sp2_ltss:15-SP2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:libflatpak0-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:system-user-flatpak:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:typelib-1_0-flatpak-1_0:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:flatpak-devel:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:libflatpak0:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20231714-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
