An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Enterprise Linux | 0, 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| oracle | oracle linux | cert_advisory | 90% |
| red hat | red hat enterprise linux | cert_advisory | 90% |
Loading…
Identified vendor as Red Hat and product as Enterprise Linux; updated severity from NONE to HIGH; added relevant tags for Red Hat and Enterprise Linux.
Initial creation
