CVE-2023-28101

Flatpak is a system for building, distributing, and running sandboxed
desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4,
and 1.15.4, if an attacker publishes a Flatpak app with elevated
permissions, they can hide those permissions from users of the flatpak(1)
command-line interface by setting other permissions to crafted values that
contain non-printable control characters such as ESC. A fix is available
in versions 1.10.8, 1.12.8, 1.14.4, and 1.15.4. As a workaround, use a GUI
like GNOME Software rather than the command-line interface, or only install
apps whose maintainers you trust.

Bugs

• <https://bugs.launchpad.net/ubuntu/+source/flatpak/+bug/2063034&gt;