Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2019-10063

critical

CVE-2019-10063

flatpak: Sandbox bypass via IOCSTI (incomplete fix for CVE-2017-5226)

Published Modified CWE 20
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.0CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Red Hat8.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Amazon (high), Oracle (high), Ubuntu (medium).

Description

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.

Affected packages and fixed versions

SourcePackageFixed in
alpine 3.10flatpak1.2.4-r0
alpine 3.11flatpak1.2.4-r0
alpine 3.12flatpak1.2.4-r0
alpine 3.13flatpak1.2.4-r0
alpine 3.14flatpak1.2.4-r0
alpine 3.15flatpak1.2.4-r0
alpine 3.16flatpak1.2.4-r0
alpine 3.17flatpak1.2.4-r0
alpine 3.18flatpak1.2.4-r0
alpine 3.19flatpak1.2.4-r0
alpine 3.20flatpak1.2.4-r0
alpine 3.21flatpak1.2.4-r0
Show all 37 entries from 29 sources
SourcePackageFixed in
alpine 3.10flatpak1.2.4-r0
alpine 3.11flatpak1.2.4-r0
alpine 3.12flatpak1.2.4-r0
alpine 3.13flatpak1.2.4-r0
alpine 3.14flatpak1.2.4-r0
alpine 3.15flatpak1.2.4-r0
alpine 3.16flatpak1.2.4-r0
alpine 3.17flatpak1.2.4-r0
alpine 3.18flatpak1.2.4-r0
alpine 3.19flatpak1.2.4-r0
alpine 3.20flatpak1.2.4-r0
alpine 3.21flatpak1.2.4-r0
alpine 3.22flatpak1.2.4-r0
alpine 3.23flatpak1.2.4-r0
alpine 3.24flatpak1.2.4-r0
alpine 3.9flatpak1.0.8-r0
alpine edgeflatpak1.2.4-r0
amazon linux 2flatpak1.0.2-5.amzn2.0.1
amazon linux 2flatpak-builder1.0.0-5.amzn2.0.1
amazon linux 2flatpak-debuginfo1.0.2-5.amzn2.0.1
amazon linux 2flatpak-devel1.0.2-5.amzn2.0.1
amazon linux 2flatpak-libs1.0.2-5.amzn2.0.1
debian 11flatpak1.2.3-2
debian 12flatpak1.2.3-2
debian 13flatpak1.2.3-2
debian 14flatpak1.2.3-2
debian 9flatpak0.8.9-0+deb9u3
echoflatpak1.2.3-2
Oracle Linux 7flatpak1.0.2-5.el7_6
Oracle Linux 7flatpak-builder1.0.0-5.el7_6
Oracle Linux 7flatpak-devel1.0.2-5.el7_6
Oracle Linux 7flatpak-libs1.0.2-5.el7_6
Oracle Linux 8flatpak1.0.6-3.el8_0
Oracle Linux 8flatpak-libs1.0.6-3.el8_0
ubuntu 18.04flatpak1.0.8-0ubuntu0.18.04.1
ubuntu 18.04-ESMflatpak1.0.8-0ubuntu0.18.04.1
ubuntu 18.10flatpak1.0.8-0ubuntu0.18.10.1

References

All 9 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.