CVE-2019-10063

Name	CVE-2019-10063
Description	Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the controlling terminal so that they would be executed outside the sandbox after the sandboxed app exits. This fix was incomplete: on 64-bit platforms, the seccomp filter could be bypassed by an ioctl request number that has TIOCSTI in its 32 least significant bits and an arbitrary nonzero value in its 32 most significant bits, which the Linux kernel would treat as equivalent to TIOCSTI.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	925541

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
flatpak (PTS)	stretch	0.8.9-0+deb9u3	fixed
	stretch (security), stretch (lts)	0.8.9-0+deb9u2	vulnerable
	buster (security), buster, buster (lts)	1.2.5-0+deb10u4	fixed
	bullseye (security), bullseye	1.10.8-0+deb11u2	fixed
	bookworm (security), bookworm	1.14.10-1~deb12u1	fixed
	sid, trixie	1.14.10-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
flatpak	source	stretch	0.8.9-0+deb9u3
flatpak	source	(unstable)	1.2.3-2			925541

https://github.com/flatpak/flatpak/issues/2782
https://github.com/flatpak/flatpak/commit/a9107feeb4b8275b78965b36bf21b92d5724699e