Test ID:	1.3.6.1.4.1.25623.1.1.10.2023.0115
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2023-0115)
Summary:	The remote host is missing an update for the 'flatpak' package(s) announced via the MGASA-2023-0115 advisory.
Description:	Summary: The remote host is missing an update for the 'flatpak' package(s) announced via the MGASA-2023-0115 advisory. Vulnerability Insight: If a malicious Flatpak app is run on a Linux virtual console such as /dev/tty1, it can copy text from the virtual console and paste it back into the virtual console's input buffer, from which the command might be run by the user's shell after the Flatpak app has exited. This is similar to CVE-2017-5226, but using the TIOCLINUX ioctl command instead of TIOCSTI. (CVE-2023-28100) Flatpak app with elevated permissions mayhide those permissions from users of the 'flatpak(1)' command-line interface by setting other permissions to crafted values that contain non-printable control characters such as 'ESC'. (CVE-2023-28101) Affected Software/OS: 'flatpak' package(s) on Mageia 8. Solution: Please install the updated package(s). CVSS Score: 4.6 CVSS Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-28100 https://security.gentoo.org/glsa/202312-12 https://github.com/flatpak/flatpak/commit/8e63de9a7d3124f91140fc74f8ca9ed73ed53be9 https://github.com/flatpak/flatpak/security/advisories/GHSA-7qpw-3vjv-xrqp https://marc.info/?l=oss-security&m=167879021709955&w=2 Common Vulnerability Exposure (CVE) ID: CVE-2023-28101 https://github.com/flatpak/flatpak/commit/409e34187de2b2b2c4ef34c79f417be698830f6c https://github.com/flatpak/flatpak/commit/6cac99dafe6003c8a4bd5666341c217876536869 https://github.com/flatpak/flatpak/commit/7fe63f2e8f1fd2dafc31d45154cf0b191ebec66c https://github.com/flatpak/flatpak/security/advisories/GHSA-h43h-fwqx-mpp8
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.