File Permission Vulnerability in Flatpak by Flatpak

CVE-2017-9780

What is CVE-2017-9780?

In versions of Flatpak prior to 0.8.7, a vulnerability exists that allows a third-party app repository to deploy applications with inappropriate file permissions. This can enable local attackers to execute setuid executables or write to world-writable locations, potentially compromising system security. Particularly concerning is the exploitation involving the 'system helper' component, where malicious files may be owned by root, allowing for severe security implications, including the execution of setuid root binaries.

References