CVE-2019-8308
N/A
Published: February 12, 2019 at 11:00 PM UTC
Updated: June 17, 2026 at 02:41 AM UTC
8 products affected across 3 vendorsDebian LinuxEnterprise Linux DesktopEnterprise Linux Server
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.5%
Description
Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Debian Linux· Debiandrupal
95%v < 1.0.71.1.0 ≤ v ≤ 1.1.31.2.0 ≤ v ≤ 1.2.3
Affected range stops below 1.0.7, so it looks safe — our inference, not a vendor statement
95%
Enterprise Linux Server· Red Hatrubygems
95%95%
95%
95%
95%
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (5)
Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00088.htmlVendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:0375x_refsource_MISCIssue TrackingMailing ListThird Party Advisory
Source: [email protected]
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=922059x_refsource_MISCThird Party Advisory
Source: [email protected]
https://github.com/flatpak/flatpak/releases/tag/1.0.7x_refsource_MISCThird Party Advisory
Source: [email protected]
https://github.com/flatpak/flatpak/releases/tag/1.2.3Quick Info
StatusMODIFIED
CWE
CWE-668
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card