The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6518 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-7197:04 advisory.

    * flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100)
      * flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-7038 advisory.

    [1.10.8-1]
    - Rebase to 1.10.8 (#2222103)
    - Fix CVE-2023-28100 and CVE-2023-28101 (#2180311)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6670:03 advisory.

    * flatpak: TIOCLINUX can send commands outside sandbox if running on a virtual console (CVE-2023-28100)
      * flatpak: Metadata with ANSI control codes can cause misleading terminal output (CVE-2023-28101)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1712-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6518 advisory.

    [1.12.8-1]
    - Update to 1.12.8 (CVE-2023-28100, CVE-2023-28101)     Resolves: #2180312, #2221792

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the flatpak-1.12.8-1.el9 build changelog.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0295 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-28100:
      Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the TIOCLINUX ioctl command instead of TIOCSTI. If a Flatpak app is run on a Linux virtual console     such as /dev/tty1, it can copy text from the virtual console and paste it into the command buffer, from     which the command might be run after the Flatpak app has exited. Ordinary graphical terminal emulators     like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the Linux virtual     consoles /dev/tty1, /dev/tty2 and so on. A patch is available in versions 1.10.8, 1.12.8, 1.14.4, and     1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is primarily designed to be     used in a Wayland or X11 graphical environment.

      CVE-2023-28101:
      Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the flatpak(1) command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as ESC. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-508e400dec advisory.

    Update to 1.15.4

    * Fix CVE-2023-28100 and CVE-2023-28101

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-b0717d8c45 advisory.

    Update to 1.14.4

    * Fix CVE-2023-28100 and CVE-2023-28101

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:1713-1 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:7038 advisory.

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment. (CVE-2023-28100)

  - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.
    (CVE-2023-28101)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0066 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-28100:
    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.
    Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but     using the `TIOCLINUX` ioctl command instead of `TIOCSTI`. If a Flatpak app is run on a Linux virtual     console such as `/dev/tty1`, it can copy text from the virtual console and paste it into the command     buffer, from which the command might be run after the Flatpak app has exited. Ordinary graphical terminal     emulators like xterm, gnome-terminal and Konsole are unaffected. This vulnerability is specific to the     Linux virtual consoles `/dev/tty1`, `/dev/tty2` and so on. A patch is available in versions 1.10.8,     1.12.8, 1.14.4, and 1.15.4. As a workaround, don't run Flatpak on a Linux virtual console. Flatpak is     primarily designed to be used in a Wayland or X11 graphical environment.

    CVE-2023-28101:
    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In     versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated     permissions, they can hide those permissions from users of the `flatpak(1)` command-line interface by     setting other permissions to crafted values that contain non-printable control characters such as `ESC`. A     fix is available in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI like GNOME     Software rather than the command-line interface, or only install apps whose maintainers you trust.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
196980	Rocky Linux 9 : flatpak (RLSA-2023:6518)	Nessus	Rocky Linux Local Security Checks	2024/5/14	2024/5/14	medium
293558	MiracleLinux 8 : flatpak-1.10.8-1.el8 (AXSA:2023-7197:04)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
186096	Oracle Linux 8 : flatpak (ELSA-2023-7038)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	medium
291812	MiracleLinux 9 : flatpak-1.12.8-1.el9 (AXSA:2023-6670:03)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
258291	Linux Distros Unpatched Vulnerability : CVE-2023-28100	Nessus	Misc.	2025/8/30	2026/4/29	medium
173766	SUSE SLES12 Security Update : flatpak (SUSE-SU-2023:1712-1)	Nessus	SuSE Local Security Checks	2023/4/2	2023/7/14	medium
185824	Oracle Linux 9 : flatpak (ELSA-2023-6518)	Nessus	Oracle Linux Local Security Checks	2023/11/16	2025/9/9	medium
191390	CentOS 9 : flatpak-1.12.8-1.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
276348	TencentOS Server 3: flatpak (TSSA-2023:0295)	Nessus	Tencent Local Security Checks	2025/11/20	2025/11/20	medium
172732	Fedora 38 : flatpak (2023-508e400dec)	Nessus	Fedora Local Security Checks	2023/3/20	2024/11/14	medium
173395	Fedora 37 : flatpak (2023-b0717d8c45)	Nessus	Fedora Local Security Checks	2023/3/24	2024/11/14	medium
173775	SUSE SLES15 Security Update : flatpak (SUSE-SU-2023:1713-1)	Nessus	SuSE Local Security Checks	2023/4/2	2023/7/14	medium
185635	CentOS 8 : flatpak (CESA-2023:7038)	Nessus	CentOS Local Security Checks	2023/11/14	2023/12/21	medium
236364	Alibaba Cloud Linux 3 : 0066: flatpak (ALINUX3-SA-2024:0066)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium