DEBIAN-CVE-2023-28101

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2023-28101
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-28101.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2023-28101
Upstream
Published
2023-03-16T16:15:12Z
Modified
2025-09-19T07:33:16.337300Z
Summary
[none]
Details

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions from users of the flatpak(1) command-line interface by setting other permissions to crafted values that contain non-printable control characters such as ESC. A fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME Software rather than the command-line interface, or only install apps whose maintainers you trust.

References

Affected packages

Debian:11 / flatpak

Package

Name
flatpak
Purl
pkg:deb/debian/flatpak?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.8-0+deb11u1

Affected versions

1.*

1.10.2-3
1.10.3-0+deb11u1~bpo11+1
1.10.3-0+deb11u1
1.10.5-0+deb11u1~bpo10+1
1.10.5-0+deb11u1
1.10.7-0+deb11u1~bpo10+1
1.10.7-0+deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / flatpak

Package

Name
flatpak
Purl
pkg:deb/debian/flatpak?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.14.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / flatpak

Package

Name
flatpak
Purl
pkg:deb/debian/flatpak?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.14.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / flatpak

Package

Name
flatpak
Purl
pkg:deb/debian/flatpak?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.14.4-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}