HIGH🇬🇧 English

CVE-2018-6560

CVSS 8.8v3.0pub. 2018-02-02upd. 2024-11-21

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

oryginał EN
CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Flatpak

    APP
    Flatpak
    < 0.8.90.9.1 – 0.9.990.10.0 – 0.10.3 (bez)

  • Red Hat Enterprise Linux Desktop

    OS
    Redhat
    7.0

  • Red Hat Enterprise Linux Server

    OS
    Redhat
    7.0

  • Red Hat Enterprise Linux Server Aus

    OS
    Redhat
    7.6

  • Red Hat Enterprise Linux Server Eus

    OS
    Redhat
    7.57.6

  • Red Hat Enterprise Linux Server Tus

    OS
    Redhat
    7.6

  • Red Hat Enterprise Linux Workstation

    OS
    Redhat
    7.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Referencje

Powiązane podatności

CVE-2021-40438CRITICAL9.0⚠ KEVten sam produkt

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remot...

CVE-2019-5544CRITICAL9.8⚠ KEVten sam produkt

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the s...

CVE-2016-4171CRITICAL9.8⚠ KEVten sam produkt

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbi...

CVE-2016-4117CRITICAL9.8⚠ KEVten sam produkt

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified ve...

CVE-2016-3427CRITICAL9.8⚠ KEVten sam produkt

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 ...