* SECURITY UPDATE: Flatpak sandbox escape via spawn portal (LP: #1911473)
- debian/patches/CVE-2021-21261-1.patch: run: Convert all environment
variables into bwrap arguments.
- debian/patches/CVE-2021-21261-2.patch: common: Move
flatpak_buffer_to_sealed_memfd_or_tmpfile to its own file.
- debian/patches/CVE-2021-21261-3.patch: context: Add --env-fd option.
- debian/patches/CVE-2021-21261-4.patch: portal: Convert --env in
extra-args into --env-fd.
- debian/patches/CVE-2021-21261-5.patch: portal: Do not use caller-supplied
variables in environment.
- CVE-2021-21261
-- Paulo Flabiano Smorigo <email address hidden> Tue, 19 Jan 2021 14:21:40 +0000
This bug was fixed in the package flatpak - 1.0.9-0ubuntu0.2
---------------
flatpak (1.0.9-0ubuntu0.2) bionic-security; urgency=medium
* SECURITY UPDATE: Flatpak sandbox escape via spawn portal (LP: #1911473) patches/ CVE-2021- 21261-1. patch: run: Convert all environment patches/ CVE-2021- 21261-2. patch: common: Move buffer_ to_sealed_ memfd_or_ tmpfile to its own file. patches/ CVE-2021- 21261-3. patch: context: Add --env-fd option. patches/ CVE-2021- 21261-4. patch: portal: Convert --env in patches/ CVE-2021- 21261-5. patch: portal: Do not use caller-supplied
- debian/
variables into bwrap arguments.
- debian/
flatpak_
- debian/
- debian/
extra-args into --env-fd.
- debian/
variables in environment.
- CVE-2021-21261
-- Paulo Flabiano Smorigo <email address hidden> Tue, 19 Jan 2021 14:21:40 +0000