SB2019050729 - Red Hat Enterprise Linux 7 update for flatpak 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019050729

SB2019050729 - Red Hat Enterprise Linux 7 update for flatpak

Published: May 7, 2019 Updated: April 24, 2025

Security Bulletin ID SB2019050729
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security features bypass (CVE-ID: CVE-2019-10063)

The vulnerability allows a malicious application to bypass implemented security restrictions.

The vulnerability exists due to improper input validation. If Flatpak runs from a terminal emulator containing an interactive shell, a malicious Flatpak app could inject input into the interactive shell by using the TIOCSTI ioctl.


2) Input validation error (CVE-ID: CVE-2017-5226)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input. The non-privileged session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input buffer, allowing an attacker to escape the sandbox.


Remediation

Install update from vendor's website.

References