CVE-2017-9780 - CVE House
Back to Database
Status published High CVE-2017-9780

In Flatpak before 0.8.7, a third-party app repository could include...

Vulnerability Description

In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" component, files deployed as part of the app are owned by root, so in the worst case they could be setuid root.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-9780

Credits & Attribution

No credits recorded in the NVD database.

References

More from flatpak

View All →
CVE-2024-42472
Flatpak may allow access to files outside sandbox for certain apps
Critical 10
CVE-2024-32462
Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing
High 8.4
CVE-2023-28101
Flatpak metadata with ANSI control codes can cause misleading terminal output
Medium 5
CVE-2023-28100
TIOCLINUX can send commands outside sandbox if running on a virtual console
Critical 10
CVE-2022-21682
flatpak-builder can access files outside the build directory.
High 7.7

Affected Vendor

Affected Software

flatpak, debian linux
Vulnerable Versions:
0, 9.0

Timeline

Official Publish: June 21st, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.