CVE-2018-6560

Опубликовано: 02 фев. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 4.6

EPSS Низкий

Описание

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

Ссылки

https://access.redhat.com/errata/RHSA-2018:2766
Third Party Advisory
https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6
Patch
Vendor Advisory
https://github.com/flatpak/flatpak/releases/tag/0.10.3
Release Notes
https://github.com/flatpak/flatpak/releases/tag/0.8.9
Release Notes
https://access.redhat.com/errata/RHSA-2018:2766
Third Party Advisory
https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6
Patch
Vendor Advisory
https://github.com/flatpak/flatpak/releases/tag/0.10.3
Release Notes
https://github.com/flatpak/flatpak/releases/tag/0.8.9
Release Notes

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*

Версия до 0.8.9 (исключая)

cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*

Версия от 0.9.1 (включая) до 0.9.99 (включая)

cpe:2.3:a:flatpak:flatpak:*:*:*:*:*:*:*:*

Версия от 0.10.0 (включая) до 0.10.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 27%

0.00094

Низкий

8.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-436

Связанные уязвимости

CVE-2018-6560

CVSS3: 8.8

ubuntu

почти 8 лет назад

CVE-2018-6560

CVSS3: 6.5

redhat

почти 8 лет назад

CVE-2018-6560

CVSS3: 8.8

debian

почти 8 лет назад

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0 ...

GHSA-5xcx-r88v-8v7g

CVSS3: 8.8

github

больше 3 лет назад

ELSA-2018-2766

oracle-oval

около 7 лет назад

ELSA-2018-2766: flatpak security update (MODERATE)

EPSS

Процентиль: 27%

0.00094

Низкий

8.8 High

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-436