CVE-2018-6560

In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.

• CWE-436

• https://access.redhat.com/errata/RHSA-2018:2766Third Party Advisory
• https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6Patch, Vendor Advisory
• https://github.com/flatpak/flatpak/releases/tag/0.10.3Release Notes
• https://github.com/flatpak/flatpak/releases/tag/0.8.9Release Notes
• https://access.redhat.com/errata/RHSA-2018:2766Third Party Advisory
• https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6Patch, Vendor Advisory
• https://github.com/flatpak/flatpak/releases/tag/0.10.3Release Notes
• https://github.com/flatpak/flatpak/releases/tag/0.8.9Release Notes

Published

Feb 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6554Memory leak in the irda_bind function in net/irda/af_irda.c …
• CVE-2018-6555The irda_setsockopt function in net/irda/af_irda.c and later…
• CVE-2018-6556lxc-user-nic when asked to delete a network interface will u…
• CVE-2018-6557The MOTD update script in the base-files package in Ubuntu 1…7
• CVE-2018-6558The pam_fscrypt module in fscrypt before 0.2.4 may incorrect…
• CVE-2018-6559The Linux kernel, as used in Ubuntu 18.04 LTS and Ubuntu 18.…
• CVE-2018-6561dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload …
• CVE-2018-6562totemomail Encryption Gateway before 6.0_b567 allows remote …
• CVE-2018-6563Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2018-6569West Wind Web Server 6.x does not require authentication for…
• CVE-2018-6574Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-rele…
• CVE-2018-6575SQL Injection exists in the JEXTN Classified 1.0.0 component…