CVE-2019-8308

Published: 12 February 2019

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

Priority

Cvss 3 Severity Score

8.2

Score breakdown

Status

Package	Release	Status
flatpak Launchpad, Ubuntu, Debian	upstream	Released (1.2.3-1)
	precise	Does not exist
	trusty	Does not exist
	xenial	Does not exist
	bionic	Released (1.0.7-0ubuntu0.18.04.1)
	cosmic	Released (1.0.7-0ubuntu0.18.10.1)

Severity score breakdown

Parameter	Value
Base score	8.2
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	Required
Scope	Changed
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H