The GNOME project developers released an update for the Yelp help application that addresses a vulnerability allowing escape from the Flatpak sandbox environment.
The issue was related to the handling of external URIs and the way Yelp integrates with application launch mechanisms. By opening a specially crafted document, an attacker could execute commands outside the sandbox constraints, gaining access to the user's system with the current user's privileges.
The vulnerability primarily affected scenarios where Yelp was used within Flatpak applications or bundled as part of a sandboxed environment. The potential for remote exploitation depended on whether the user was tricked into opening a malicious help file or link.
The fix is already included in new versions of Yelp and is starting to appear in distribution packages. GNOME developers have also strengthened URI checks and restricted unsafe methods of launching external handlers.
It is noteworthy that the incident has once again drawn attention to the issues of desktop integration of sandbox mechanisms in Linux. Despite Flatpak's isolation, flaws in desktop components and MIME/URI handlers remain a primary method for bypassing restrictions.
Source: linux.org.ru
