CVE-2019-8308

HIGH8.2EPSS 0.06%

flatpak - security update

Published: 2/12/2019Modified: 4/28/2026

Also known as:DSA-4390-1DEBIAN-CVE-2019-8308

Description

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

Affected packages (2)

Debian/flatpakfrom 0, < 1.2.3-1
Debian/flatpakfrom 0, < 0.8.9-0+deb9u2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.2	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References (1)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-8308