CVE-2018-6560: In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the…

PriorityP338high8.8CVSS 3.0

AVLACLPRLUINSCCHIHAH

EPSS

0.41%

33.8th percentile

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	flatpak	< flatpak 0.10.3-1 (bookworm)	flatpak 0.10.3-1 (bookworm)
flatpak	flatpak	< 0.8.9	0.8.9
flatpak	flatpak	>= 0 < 0.10.3-1	0.10.3-1
flatpak	flatpak	>= 0 < 0.10.3-1	0.10.3-1
flatpak	flatpak	>= 0 < 0.10.3-1	0.10.3-1
flatpak	flatpak	>= 0 < 0.10.3-1	0.10.3-1
flatpak	flatpak	>= 0.10.0 < 0.10.3	0.10.3
flatpak	flatpak	0.9.1 – 0.9.99	—
redhat	enterprise_linux_desktop	—	—
redhat	enterprise_linux_server	—	—
redhat	enterprise_linux_server_aus	—	—
redhat	enterprise_linux_server_eus	—	—
redhat	enterprise_linux_server_eus	—	—
redhat	enterprise_linux_server_tus	—	—
redhat	enterprise_linux_workstation	—	—

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

osv8.8HIGH

vendor_debian8.8HIGH

vendor_redhat8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.