Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2026-34078

kritik

CVE-2026-34078

flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options

Yayın Değişiklik CWE 61, 59
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), AlmaLinux (yüksek), Amazon (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (orta).

Açıklama

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This gives apps access to all host files and can be used as a primitive to gain code execution in the host context. This vulnerability is fixed in 1.16.4.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
alma 10flatpak, flatpak-devel, flatpak-libs ve 2 tane daha1.16.0-9.el10_2.1
alma 8flatpak, flatpak-devel, flatpak-libs ve 2 tane daha1.12.9-4.el8_10
alma 9flatpak, flatpak-devel, flatpak-libs ve 2 tane daha1.12.9-4.el9_8.1
alpine 3.23flatpak1.16.4-r0
alpine 3.24flatpak1.16.4-r0
alpine edgeflatpak1.16.4-r0
amazon linux 2flatpak, flatpak-builder, flatpak-debuginfo ve 2 tane daha1.0.9-10.amzn2.0.7 ve 1 tane daha
amazon linux 2023flatpak, flatpak-debuginfo, flatpak-debugsource ve 8 tane daha1.16.6-1.amzn2023
debian 11flatpakdüzeltme belirtilmemiş
debian 12flatpak1.14.10-1~deb12u2
debian 13flatpak1.16.6-1~deb13u1
debian 14flatpak1.16.4-1
37 kaynaktaki 110 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
alma 10flatpak1.16.0-9.el10_2.1
alma 10flatpak-devel1.16.0-9.el10_2.1
alma 10flatpak-libs1.16.0-9.el10_2.1
alma 10flatpak-selinux1.16.0-9.el10_2.1
alma 10flatpak-session-helper1.16.0-9.el10_2.1
alma 8flatpak1.12.9-4.el8_10
alma 8flatpak-devel1.12.9-4.el8_10
alma 8flatpak-libs1.12.9-4.el8_10
alma 8flatpak-selinux1.12.9-4.el8_10
alma 8flatpak-session-helper1.12.9-4.el8_10
alma 9flatpak1.12.9-4.el9_8.1
alma 9flatpak-devel1.12.9-4.el9_8.1
alma 9flatpak-libs1.12.9-4.el9_8.1
alma 9flatpak-selinux1.12.9-4.el9_8.1
alma 9flatpak-session-helper1.12.9-4.el9_8.1
alpine 3.23flatpak1.16.4-r0
alpine 3.24flatpak1.16.4-r0
alpine edgeflatpak1.16.4-r0
amazon linux 2flatpak1.0.9-10.amzn2.0.7
amazon linux 2flatpak-builder1.0.0-10.amzn2.0.7
amazon linux 2flatpak-debuginfo1.0.9-10.amzn2.0.7
amazon linux 2flatpak-devel1.0.9-10.amzn2.0.7
amazon linux 2flatpak-libs1.0.9-10.amzn2.0.7
amazon linux 2023flatpak1.16.6-1.amzn2023
amazon linux 2023flatpak-debuginfo1.16.6-1.amzn2023
amazon linux 2023flatpak-debugsource1.16.6-1.amzn2023
amazon linux 2023flatpak-devel1.16.6-1.amzn2023
amazon linux 2023flatpak-libs1.16.6-1.amzn2023
amazon linux 2023flatpak-libs-debuginfo1.16.6-1.amzn2023
amazon linux 2023flatpak-selinux1.16.6-1.amzn2023
amazon linux 2023flatpak-session-helper1.16.6-1.amzn2023
amazon linux 2023flatpak-session-helper-debuginfo1.16.6-1.amzn2023
amazon linux 2023flatpak-tests1.16.6-1.amzn2023
amazon linux 2023flatpak-tests-debuginfo1.16.6-1.amzn2023
debian 11flatpakdüzeltme belirtilmemiş
debian 12flatpak1.14.10-1~deb12u2
debian 13flatpak1.16.6-1~deb13u1
debian 14flatpak1.16.4-1
echoflatpak1.14.10-1~deb12u2
Oracle Linux 7flatpak1.12.9-4.0.1.el7
Oracle Linux 7flatpak-builder1.0.0-17.0.1.el7
Oracle Linux 7flatpak-devel1.12.9-4.0.1.el7
Oracle Linux 7flatpak-libs1.12.9-4.0.1.el7
Oracle Linux 8flatpak1.12.9-4.el8_10
Oracle Linux 8flatpak-devel1.12.9-4.el8_10
Oracle Linux 8flatpak-libs1.12.9-4.el8_10
Oracle Linux 8flatpak-selinux1.12.9-4.el8_10
Oracle Linux 8flatpak-session-helper1.12.9-4.el8_10
Oracle Linux 9flatpak1.12.9-4.el9_8.1
Oracle Linux 9flatpak-devel1.12.9-4.el9_8.1
Oracle Linux 9flatpak-libs1.12.9-4.el9_8.1
Oracle Linux 9flatpak-selinux1.12.9-4.el9_8.1
Oracle Linux 9flatpak-session-helper1.12.9-4.el9_8.1
rapidfort alma 10flatpak1.16.0-9.el10_2.1
rapidfort alma 10flatpak-devel1.16.0-9.el10_2.1
rapidfort alma 10flatpak-libs1.16.0-9.el10_2.1
rapidfort alma 10flatpak-selinux1.16.0-9.el10_2.1
rapidfort alma 10flatpak-session-helper1.16.0-9.el10_2.1
rapidfort alma 9flatpak1.12.9-4.el9_8.1
rapidfort alma 9flatpak-libs1.12.9-4.el9_8.1
rapidfort alma 9flatpak-selinux1.12.9-4.el9_8.1
rapidfort alma 9flatpak-session-helper1.12.9-4.el9_8.1
rapidfort alpine 3.20flatpak1.16.4-r0
rapidfort alpine 3.21flatpak1.16.4-r0
rapidfort alpine 3.22flatpak1.16.4-r0
rapidfort amazon linux 2023flatpak1.16.6-1.amzn2023
rapidfort amazon linux 2023flatpak-devel1.16.6-1.amzn2023
rapidfort amazon linux 2023flatpak-libs1.16.6-1.amzn2023
rapidfort amazon linux 2023flatpak-selinux1.16.6-1.amzn2023
rapidfort amazon linux 2023flatpak-session-helper1.16.6-1.amzn2023
rapidfort amazon linux 2023flatpak-tests1.16.6-1.amzn2023
rapidfort debian 12flatpak0:1.16.4-1, 0:1.16.6-1~deb13u1
rapidfort debian 13flatpak0:1.16.4-1, 0:1.16.6-1~deb13u1
rapidfort fedora 43flatpak1.16.4-1.fc43
rapidfort fedora 43flatpak-devel1.16.4-1.fc43
rapidfort fedora 43flatpak-libs1.16.4-1.fc43
rapidfort fedora 43flatpak-selinux1.16.4-1.fc43
rapidfort fedora 43flatpak-session-helper1.16.4-1.fc43
rapidfort fedora 43flatpak-tests1.16.4-1.fc43
rapidfort Oracle Linux 10flatpak0:1.16.0-9.el10_2.1
rapidfort Oracle Linux 10flatpak-devel0:1.16.0-9.el10_2.1
rapidfort Oracle Linux 10flatpak-libs0:1.16.0-9.el10_2.1
rapidfort Oracle Linux 10flatpak-selinux0:1.16.0-9.el10_2.1
rapidfort Oracle Linux 10flatpak-session-helper0:1.16.0-9.el10_2.1
rapidfort Oracle Linux 9flatpak0:1.12.9-4.el9_8.1
rapidfort Oracle Linux 9flatpak-devel0:1.12.9-4.el9_8.1
rapidfort Oracle Linux 9flatpak-libs0:1.12.9-4.el9_8.1
rapidfort Oracle Linux 9flatpak-selinux0:1.12.9-4.el9_8.1
rapidfort Oracle Linux 9flatpak-session-helper0:1.12.9-4.el9_8.1
rapidfort rocky 9flatpak0:1.12.9-4.el9_8.1
rapidfort rocky 9flatpak-libs0:1.12.9-4.el9_8.1
rapidfort rocky 9flatpak-session-helper0:1.12.9-4.el9_8.1
rapidfort ubuntu 20.04flatpak0:1.16.4-1
rapidfort ubuntu 22.04flatpak0:1.16.4-1
rapidfort ubuntu 24.04flatpak0:1.16.4-1
rocky 10flatpak1.16.0-9.el10_2.1
rocky 10flatpak-libs1.16.0-9.el10_2.1
rocky 10flatpak-selinux1.16.0-9.el10_2.1
rocky 10flatpak-session-helper1.16.0-9.el10_2.1
rocky 8flatpak1.12.9-4.el8_10
rocky 8flatpak-libs1.12.9-4.el8_10
rocky 8flatpak-selinux1.12.9-4.el8_10
rocky 8flatpak-session-helper1.12.9-4.el8_10
rocky 9flatpak1.12.9-4.el9_8.1
rocky 9flatpak-libs1.12.9-4.el9_8.1
rocky 9flatpak-selinux1.12.9-4.el9_8.1
rocky 9flatpak-session-helper1.12.9-4.el9_8.1
ubuntu 20.04-ESMflatpak1.6.5-0ubuntu0.5+esm1
ubuntu 22.04flatpakdüzeltme belirtilmemiş
ubuntu 24.04flatpakdüzeltme belirtilmemiş

Referanslar

30 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.