CVE-2018-6560 - CVE House
Back to Database
Status published High CVE-2018-6560

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x...

Vulnerability Description

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-6560

Credits & Attribution

No credits recorded in the NVD database.

References

More from flatpak

View All →
CVE-2024-42472
Flatpak may allow access to files outside sandbox for certain apps
Critical 10
CVE-2024-32462
Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing
High 8.4
CVE-2023-28101
Flatpak metadata with ANSI control codes can cause misleading terminal output
Medium 5
CVE-2023-28100
TIOCLINUX can send commands outside sandbox if running on a virtual console
Critical 10
CVE-2022-21682
flatpak-builder can access files outside the build directory.
High 7.7

Affected Vendor

Affected Software

flatpak, enterprise linux desktop, enterprise linux server, enterprise linux server aus, enterprise linux server eus, enterprise linux server tus, enterprise linux workstation
Vulnerable Versions:
0, 0.9.1, 0.10.0, 7.0, 7.6, 7.5

Timeline

Official Publish: February 2nd, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.