CVE-2017-9780

NONE EPSS 27.5%
Published Jun 21, 20179y ago · Modified Jun 17, 20262w ago
Find Similar
Published Jun 21, 2017 9y ago
Last Modified Jun 17, 2026 2w ago

Description

In Flatpak before 0.8.7, a third-party app repository could include malicious apps that contain files with inappropriate permissions, for example setuid or world-writable. The files are deployed with those permissions, which would let a local attacker run the setuid executable or write to the world-writable location. In the case of the "system helper" component, files deployed as part of the app are owned by root, so in the worst case they could be setuid root.

Threat Intelligence

EPSS Exploit Probability
27.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-732

Affected Products 2

VendorProductVersionRange
flatpakflatpak* ≤0.8.6
debiandebian_linux9.0any

References 4

  • debian.org http://www.debian.org/security/2017/dsa-3895
    Third Party Advisory
  • securityfocus.com http://www.securityfocus.com/bid/99346
    Third Party AdvisoryVDB Entry
  • bugs.debian.org https://bugs.debian.org/865413
    Issue TrackingPatchThird Party Advisory
  • github.com https://github.com/flatpak/flatpak/issues/845
    Issue TrackingPatchThird Party Advisory

Remediation

  • bugs.debian.org https://bugs.debian.org/865413
    Issue TrackingPatchThird Party Advisory
  • github.com https://github.com/flatpak/flatpak/issues/845
    Issue TrackingPatchThird Party Advisory