CVE catalog

CVE-2019-11460

Security update for flatpak

Severity: Medium · CVSS 4.8CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Published: Apr 22, 2019, 12:00:00 AM UTC
Updated: Aug 29, 2026, 7:00:35 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.95% · Oct 25, 2026

An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	gnome-desktop3	11	`3.30.2.1-2`	fixed
Ubuntu	gnome-desktop3	18.04	`3.26.1-0ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.26.2-1ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.27.90-1ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.27.92-0ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.0-0ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.1-1ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.2-0ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.2-0ubuntu1.1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.2-0ubuntu1.2`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.2-0ubuntu1.3`	fixed
Ubuntu	gnome-desktop3	18.04	`3.26.1-0ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.26.2-1ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.27.90-1ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.27.92-0ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.0-0ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.1-1ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.2-0ubuntu1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.2-0ubuntu1.1`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.2-0ubuntu1.2`	vulnerable
Ubuntu	gnome-desktop3	18.04	`3.28.2-0ubuntu1.3`	fixed
Opensuse	gnome-desktop	tumbleweed	`40.4-1.3`	fixed
Opensuse	gnome-desktop	leap 15.3	`3.26.2-150000.4.3.1`	fixed
Opensuse	gnome-desktop	leap 15.4	`3.26.2-150000.4.3.1`	fixed
Suse	flatpak	linux enterprise module for desktop applications 15	`0.10.4-4.10.1`	fixed
Opensuse	flatpak	leap 15.0	`0.10.4-lp150.8.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	gnome-desktop3	deb	11	`3.30.2.1-2`	Not reported	DEBIAN-CVE-2019-11460	Not reported
Ubuntu	gnome-desktop3	deb	18.04	`3.28.2-0ubuntu1.3`	Not reported	UBUNTU-CVE-2019-11460	Not reported
Ubuntu	gnome-desktop3	deb	18.04	`3.28.2-0ubuntu1.3`	Not reported	USN-3994-1	Not reported
Opensuse	gnome-desktop	rpm	tumbleweed	`40.4-1.3`	Not reported	OPENSUSE-SU-2024:10796-1	Not reported
Opensuse	gnome-desktop	rpm	leap 15.3	`3.26.2-150000.4.3.1`	Not reported	SUSE-SU-2022:3837-1	Not reported
Opensuse	gnome-desktop	rpm	leap 15.4	`3.26.2-150000.4.3.1`	Not reported	SUSE-SU-2022:3837-1	Not reported
Suse	flatpak	rpm	linux enterprise module for desktop applications 15	`0.10.4-4.10.1`	Not reported	SUSE-SU-2019:2185-1	Not reported
Opensuse	flatpak	rpm	leap 15.0	`0.10.4-lp150.8.1`	Not reported	OPENSUSE-SU-2019:2038-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[openSUSE Tumbleweed]

[gnome-desktop-lang]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · noarch · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[libgnome-desktop-3_0-common]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[libgnome-desktop-3-20]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[libgnome-desktop-3-devel]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[libgnome-desktop-4-2]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[libgnome-desktop-4-devel]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[typelib-1_0-GnomeBG-4_0]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[typelib-1_0-GnomeDesktop-3_0]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[typelib-1_0-GnomeDesktop-4_0]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed
[typelib-1_0-GnomeRR-4_0]Unknown
Source package: [gnome-desktop]
Details (1)
- 44.5-1.6 · x86_64 · tumbleweed
  Unknown · Fixed: 40.4-1.3
  Version impact unknown
  pypi · gnome-desktop · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:38:43 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]