The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3174-1 advisory.

    - CVE-2024-42472: Fixed access to files outside sandbox for apps using persistent (bsc#1229157)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-6356 advisory.

    - Add support for --bind-fd and --ro-bind-fd (CVE-2024-42472)

    flatpak
    - Backport upstream patches for CVE-2024-42472

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6422 advisory.

    Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid     binary on kernels without user namespaces.

    Security Fix(es):

    * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:6356 advisory.

    * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-6422 advisory.

    - Backport upstream fix to help address CVE-2024-42472 in flatpak

    flatpak
    - Backport upstream patches for CVE-2024-42472

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-6417 advisory.

    [1.0.9-13.0.1]
    - Fix CVE-2024-42472  [Orabug: 37027734]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-726 advisory.

    A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting     persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass     the intended restrictions, enabling access to and modification of files outside the designated sandbox. As     a result, the attacker could potentially manipulate the file system, leading to unauthorized actions that     compromise the security and integrity of the system.

    Flatpak is not providing a security boundary that protects the OS from untrusted content in the flatpak.
    Flatpak applications should be vetted and reviewed with the same attention as regular OS packages. It     should be assumed that an installed flatpak shares the same privileges and access than the user running     it. (CVE-2024-42472)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-0c6db96fc3 advisory.

    Update to 1.15.10 (CVE-2024-42472)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-9109:02 advisory.

    * flatpak: Access to files outside sandbox for apps using persistent= (--persist) (CVE-2024-42472)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0502 advisory.

    Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:

    CVE-2024-42472:
    Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.

    When persistent=subdir is used in the application permissions (represented as --persist=subdir in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory subdir. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     ~/.var/app/$APPID/subdir. This allows existing apps that are not aware of the per-application directory to     still work as intended without general home directory access.

    However, the application does have write access to the application directory ~/.var/app/$APPID where this     directory is stored. If the source directory for the persistent/--persist option is replaced by a symlink,     then the next time the application is started, the bind mount will follow the symlink and mount whatever     it points to into the sandbox.

    Partial protection against this vulnerability can be provided by patching Flatpak using the patches in     commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by two     instances of a malicious app running in parallel. Closing the race condition requires updating or patching     the version of bubblewrap that is used by Flatpak to add the new --bind-fd option using the patch and then     patching Flatpak to use it. If Flatpak has been configured at build-time with -Dsystem_bubblewrap=bwrap     (1.15.x) or --with-system-bubblewrap=bwrap (1.14.x or older), or a similar option, then the version of     bubblewrap that needs to be patched is a system copy that is distributed separately, typically     /usr/bin/bwrap. This configuration is the one that is typically used in Linux distributions. If Flatpak     has been configured at build-time with -Dsystem_bubblewrap= (1.15.x) or with --without-system-bubblewrap     (1.14.x or older), then it is the bundled version of bubblewrap that is included with Flatpak that must be     patched. This is typically installed as /usr/libexec/flatpak-bwrap. This configuration is the default when     building from source code.

    For the 1.14.x stable branch, these changes are included in Flatpak 1.14.10. The bundled version of     bubblewrap included in this release has been updated to 0.6.3. For the 1.15.x development branch, these     changes are included in Flatpak 1.15.10. The bundled version of bubblewrap in this release is a Meson     wrap subproject, which has been updated to 0.10.0. The 1.12.x and 1.10.x branches will not be updated     for this vulnerability. Long-term support OS distributions should backport the individual changes into     their versions of Flatpak and bubblewrap, or update to newer versions if their stability policy allows it.
    As a workaround, avoid using applications using the persistent (--persist) permission.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-RU-2025:0145-1 advisory.

    This update for bubblewrap, flatpak updates flatpak to 1.16.0.

    flatpak changes:

    - Update to version 1.16.0:

      - Bug fixes:

        - Update libglnx to 2024-12-06:

          . Fix an assertion failure if creating a parent directory             encounters a dangling symlink.
          . Fix a Meson warning.
          . Don't emit terminal progress indicator escape sequences by             default. They are interpreted as notifications by some             terminal emulators.
        - Fix introspection annotations in libflatpak.

      - Enhancements:

        - Add the FLATPAK_TTY_PROGRESS environment variable, which           re-enables the terminal progress indicator escape sequences           added in 1.15.91.
        - Document the FLATPAK_FANCY_OUTPUT environment variable, which           allows disabling the fancy formatting when outputting to a           terminal.

    Update to version 1.15.91 (unstable):

      - Enhancements:

        - Add the FLATPAK_DATA_DIR environment variable, which allows           overriding at runtime the data directory location that           Flatpak uses to search for configuration files such as           remotes. This is useful for running tests, and for when           installing using Flatpak in a chroot.
        - Add a FLATPAK_DOWNLOAD_TMPDIR variable. This allows using           download directories other than /var/tmp.
        - Emit progress escape sequence. This can be used by terminal           emulators to detect and display progress of Flatpak           operations on their graphical user interfaces.

      - Bug fixes:

        - Install missing test data. This should fix 'as-installed'           tests via ginsttest-runner, used for example in Debian's           autopkgtest framework.
        - Unify and improve how the Wayland socket is passed to the           sandboxed app. This should fix a regression that is triggered           by compositors that both implement the security-context-v1           protocol, and sets the WAYLAND_DISPLAY environment variable           when launching Flatpak apps.
        - Fix the plural form of a translatable string.

    Update to version 1.15.12:

      - Return to using the process ID of the Flatpak app in the cgroup         name. Using the instance ID in 1.15.11 caused crashes when         installing apps, extensions or runtimes that use the 'extra         data' mechanism, which does not set up an instance ID.

    Changes from version 1.15.11:

      - Dependencies:

        - In distributions that compile Flatpak to use a separate           xdg-dbus-proxy executable, version 0.1.6 is recommended (but           not required).
        - The minimum xdg-dbus-proxy continues to be 0.1.0.

      - Enhancements:

        - Allow applications like WebKit to connect the AT-SPI           accessibility tree of processes in a sub-sandbox with the           tree in the main process.
          . New sandboxing parameter flatpak run --a11y-own-name, which             is like --own-name but for the accessibility bus.
          . flatpak-portal API v7: add new sandbox-a11y-own-names             option, which accepts names matching ${FLATPAK_ID}.*           . Apps may call the org.a11y.atspi.Socket.Embedded method on             names matching ${FLATPAK_ID}.Sandboxed.* by default           . flatpak run -vv $app_id shows all applicable sandboxing             parameters and their source, including overrides, as debug             messages
        - Introduce USB device listing           . Apps can list which USB devices they want to access ahead             of time by using the --usb parameter. Check the manpages             for the more information about the accepted syntax.
          . Denying access to USB devices is also possible with the
            --no-usb parameter. The syntax is equal to --usb.
          . Both options merely store metadata, and aren't used by             Flatpak itself. This metadata is intended to be used by the             (as of now, still in progress) USB portal to decide which             devices the app can enumerate and request access.
        - Add support for KDE search completion
        - Use the instance id of the Flatpak app as part of the cgroup           name. This better matches the naming conventions for cgroup.

      - Bug fixes:

        - Update libglnx to 2024-08-23
        - fix build in environments that use -Werror=return-type, such           as openSUSE Tumbleweed
        - add a fallback definition for G_PID_FORMAT with older GLib
        - avoid warnings for g_steal_fd() with newer GLib
        - improve compatibility of g_closefrom() backport with newer           GLib
        - Update meson wrap file for xdg-dbus-proxy to version 0.1.6:
        - compatibility with D-Bus implementations that pipeline the           authentication handshake, such as sd-bus and zbus
        - compatibility with D-Bus implementations that use           non-consecutive serial numbers, such as godbus and zbus
        - broadcast signals can be allowed without having to add TALK           permission
        - fix memory leaks

      - Internal changes:

        - Better const-correctness
        - Fix a shellcheck warning in the tests

    - add weak dep on p11-kit-server for certificate transfer (boo#1188902)
    - disable parental controls for now by using '-Dmalcontent=disabled', to work around       issues with xdg-desktop-portal

    Update to version 1.14.10:

      - Dependencies: In distributions that compile Flatpak to use a         separate bubblewrap (bwrap) executable, either version 0.10.0,         version 0.6.x  0.6.3, or a version with a backport of the
        --bind-fd option is required. These versions add a new feature         which is required by the security fix in this release.
      - Security fixes: Don't follow symbolic links when mounting         persistent directories (--persist option). This prevents a         sandbox escape where a malicious or compromised app could edit         the symlink to point to a directory that the app should not have         been allowed to read or write. (bsc#1229157, CVE-2024-42472,         GHSA-7hgv-f2j8-xw87)
      - Documentation: Mark the 1.12.x and 1.10.x branches as         end-of-life (#5352)
      - Version 1.14.9 was not released due to an incompatibility with         older versions of GLib. Version 1.14.10 replaces it.

    Update to version 1.14.8:

      - No changes. This release is rolling out to correct mismatching         submodule versions in the release tarball.

    Update to version 1.14.7:

      - New features: Automatically reload D-Bus session bus         configuration after installing or upgrading apps, to pick up         any exported D-Bus services (#3342)
      - Bug fixes:
        - Expand the list of environment variables that Flatpak apps do           not inherit from the host system (#5765, #5785)
        - Don't refuse to start apps when there is no D-Bus system bus           available (#5076)
        - Don't try to repeat migration of apps whose data was migrated           to a new name and then deleted (#5668)
        - Fix warnings from newer GLib versions (#5660)
        - Always set the container environment variable (#5610)
        - In flatpak ps, add xdg-desktop-portal-gnome to the list of           backends we'll use to learn which apps are running in the           background (#5729)
        - Avoid leaking a temporary variable from           /etc/profile.d/flatpak.sh into the shell environment (#5574)
        - Avoid undefined behaviour of signed left-shift when storing           object IDs in a hash table (#5738)
        - Fix Docbook validity in documentation (#5719)
        - Skip more tests when FUSE isn't available (#5611)
        - Fix a misleading comment in the test for CVE-2024-32462           (#5779)
      - Internal changes:
        - Fix Github Workflows recipes

    Update to version 1.14.6:

      - Security fixes:
        - Don't allow an executable name to be misinterpreted as a           command-line option for bwrap(1). This prevents a sandbox           escape where a malicious or compromised app could ask           xdg-desktop-portal to generate a .desktop file with access           to files outside the sandbox. (CVE-2024-32462, bsc#1223110)
      - Other bug fixes:
        - Don't parse <developer><name/></developer> as the application           name (#5700)

    bubblewrap changes:

    Update to 0.11.0:

     * New --overlay, --tmp-overlay, --ro-overlay and --overlay-src        options allow creation of overlay mounts. This feature is not        available when bubblewrap is installed setuid.
     * New --level-prefix option produces output that can be parsed        by tools like logger --prio-prefix and        systemd-cat --level-prefix=1
     * bug fixes and developer visible changes

    Update to version v0.10.0:

     * New features: Add the --[ro-]bind-fd option, which can be used        to mount a filesystem represented by a file descriptor without        time-of-check/time-of-use attacks. This is needed when        resolving security issue in Flatpak.
       (CVE-2024-42472, bsc#1229157)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to 10.3 / AHV-10.3. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-10.3 advisory.

  - libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a use-after-free in xmlSchemaIDCFillNodeTables and     xmlSchemaBubbleIDCNodeTables in xmlschemas.c. To exploit this, a crafted XML document must be validated     against an XML schema with certain identity constraints, or a crafted XML schema must be used.
    (CVE-2024-56171)

  - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option>     elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods     (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
    (CVE-2020-11023)

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result     prefixes. (CVE-2024-55549)

  - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath     context node can be modified but never restored. This is related to xsltNumberFormatGetValue,     xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)

  - Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and     1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files     outside of what it would otherwise have access to, which is an attack on integrity and confidentiality.
    When `persistent=subdir` is used in the application permissions (represented as `--persist=subdir` in the     command-line interface), that means that an application which otherwise doesn't have access to the real     user home directory will see an empty home directory with a writeable subdirectory `subdir`. Behind the     scenes, this directory is actually a bind mount and the data is stored in the per-application directory as     `~/.var/app/$APPID/subdir`. This allows existing apps that are not aware of the per-application directory     to still work as intended without general home directory access. However, the application does have write     access to the application directory `~/.var/app/$APPID` where this directory is stored. If the source     directory for the `persistent`/`--persist` option is replaced by a symlink, then the next time the     application is started, the bind mount will follow the symlink and mount whatever it points to into the     sandbox. Partial protection against this vulnerability can be provided by patching Flatpak using the     patches in commits ceec2ffc and 98f79773. However, this leaves a race condition that could be exploited by     two instances of a malicious app running in parallel. Closing the race condition requires updating or     patching the version of bubblewrap that is used by Flatpak to add the new `--bind-fd` option using the     patch and then patching Flatpak to use it. If Flatpak has been configured at build-time with     `-Dsystem_bubblewrap=bwrap` (1.15.x) or `--with-system-bubblewrap=bwrap` (1.14.x or older), or a similar     option, then the version of bubblewrap that needs to be patched is a system copy that is distributed     separately, typically `/usr/bin/bwrap`. This configuration is the one that is typically used in Linux     distributions. If Flatpak has been configured at build-time with `-Dsystem_bubblewrap=` (1.15.x) or with     `--without-system-bubblewrap` (1.14.x or older), then it is the bundled version of bubblewrap that is     included with Flatpak that must be patched. This is typically installed as `/usr/libexec/flatpak-bwrap`.
    This configuration is the default when building from source code. For the 1.14.x stable branch, these     changes are included in Flatpak 1.14.10. The bundled version of bubblewrap included in this release has     been updated to 0.6.3. For the 1.15.x development branch, these changes are included in Flatpak 1.15.10.
    The bundled version of bubblewrap in this release is a Meson wrap subproject, which has been updated to     0.10.0. The 1.12.x and 1.10.x branches will not be updated for this vulnerability. Long-term support OS     distributions should backport the individual changes into their versions of Flatpak and bubblewrap, or     update to newer versions if their stability policy allows it. As a workaround, avoid using applications     using the `persistent` (`--persist`) permission. (CVE-2024-42472)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
206877	SUSE SLES15: bubblewrap / flatpak / flatpak-devel / flatpak-zsh-completion / etc (SUSE-SU-2024:3174-1)	Nessus	SuSE Local Security Checks	2024/9/10	2026/6/25	critical
206655	Oracle Linux 9 : bubblewrap / and / flatpak (ELSA-2024-6356)	Nessus	Oracle Linux Local Security Checks	2024/9/5	2025/9/11	critical
206662	RHEL 8 : bubblewrap and flatpak (RHSA-2024:6422)	Nessus	Red Hat Local Security Checks	2024/9/5	2025/8/20	critical
206665	AlmaLinux 9 : bubblewrap and flatpak (ALSA-2024:6356)	Nessus	Alma Linux Local Security Checks	2024/9/5	2025/8/20	critical
206682	Oracle Linux 8 : bubblewrap / and / flatpak (ELSA-2024-6422)	Nessus	Oracle Linux Local Security Checks	2024/9/5	2025/9/11	critical
208036	Oracle Linux 7 : flatpak (ELSA-2024-6417)	Nessus	Oracle Linux Local Security Checks	2024/10/2	2025/9/11	critical
208975	Amazon Linux 2023 : bubblewrap (ALAS2023-2024-726)	Nessus	Amazon Linux Local Security Checks	2024/10/14	2025/8/20	critical
211225	Fedora 41 : flatpak (2024-0c6db96fc3)	Nessus	Fedora Local Security Checks	2024/11/14	2025/8/20	critical
292562	MiracleLinux 9 : bubblewrap-0.4.1-8.el9, flatpak-1.12.9-3.el9 (AXSA:2024-9109:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
239791	TencentOS Server 2: flatpak (TSSA-2024:0502)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	critical
229463	Linux Distros Unpatched Vulnerability : CVE-2024-42472	Nessus	Misc.	2025/3/5	2026/6/9	critical
214292	SUSE SLED15: bubblewrap / bubblewrap-zsh-completion / flatpak / flatpak-devel / etc (SUSE-SU-SUSE-RU-2025:0145-1)	Nessus	SuSE Local Security Checks	2025/1/17	2026/6/26	critical
240537	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-10.3)	Nessus	Misc.	2025/6/25	2026/7/15	high

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high