Fedora 30 : snapd-glib (2019-b6612c5fe5)

Update to v1.48 - New API : - snapdclientgetconnectionsasync - snapdclientgetconnectionsfinish - snapdclientgetconnectionssync - snapdclientgetinterfaces2async - snapdclientgetinterfaces2finish - snapdclientgetinterfaces2sync - snapdclientgetsnapconfasync - snapdclientgetsnapconffinish -...

Fedora 29 : snapd-glib (2019-bc3dfb389f)

Update to v1.48 - New API : - snapdclientgetconnectionsasync - snapdclientgetconnectionsfinish - snapdclientgetconnectionssync - snapdclientgetinterfaces2async - snapdclientgetinterfaces2finish - snapdclientgetinterfaces2sync - snapdclientgetsnapconfasync - snapdclientgetsnapconffinish -...

June 20, 2019—KB4503283 (Preview of Monthly Rollup)

None None...

Microsoft Management Console Bugs Allow Windows Takeover

A Windows interface that allows system administrators to configure and monitor systems from an admin level has several vulnerabilities that would allow an attacker to install malicious payloads and even take over a target, privileged machine. The bugs are grouped under one umbrella CVE-2019-0948...

Symlink Attack

github.com/snapcore/snapd is vulnerable to symlink attack. A malicious current working directory can be used to bypass permission checks on a multi-user system. The vulnerability can be exploited when snap-confine changes the current working directory and attempts to restore the original working...

Design/Logic Flaw

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory. Remediation...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass." Remediation Upgrade...

DEBIAN-CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

Directory traversal

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

UBUNTU-CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

CVE-2019-11503

CVE-2019-11503 concerns the snap-confine component included in snapd before 2.39, where a symlink race during a chdir() to the caller’s CWD could enable a cwd restore permission bypass. The vulnerability is documented in multiple sources (NVD, OSV) with the same description. The risk context indi...

CVE-2019-11502

CVE-2019-11502 concerns snap-confine in snapd before 2.38, where ownership of a snap application's resources could be set to the UID/GID of the first calling user. This allowed that user to access a private /tmp directory, a local authority issue that attackers could exploit to modify or read tra...