CVE-2019-8308: Debian Linux

High severity, CVSS 8.2. EPSS: 0.5% chance of exploitation in the next 30 days.

Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Flatpak Flatpak: before 1.0.7 (fixed in 1.0.7); from 1.1.0, up to and including 1.1.3; from 1.2.0, up to and including 1.2.3
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.6 only
• Red Hat Enterprise Linux Server Eus: version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only
• Red Hat Enterprise Linux Workstation: version 7.0 only

Published 2019-02-12. Last modified 2026-06-17.