4.0
Moyenne
CVE-2026-96807 In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing…
Description
In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| flatpak 1.18 | premières → < 1.18.1 | 1.18.1 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de flatpak
Les 15 CVE de flatpak →
CVE-2026-92162
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux
7.2
Élevée
CVE-2026-96808
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from…
7.4
Élevée
CVE-2026-90616
In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host,…
7.4
Élevée
CVE-2026-34079
Flatpak is a Linux application sandboxing and distribution framework
8.7
Élevée