CVE-2016-1579

creationtimestamp| type| source ---|---|--- 2019-04-22 20:30:37+00:00| seen| https://t.me/cibsecurity/3852...

CVE-2016-1579

The CVE describes a vulnerability in UDM where post-download commands are not restricted to confined apps, allowing any confined application to invoke UDM’s C++ API to run arbitrary commands as the phablet user in an unconfined environment. Affected component: UDM’s post-processing command execut...

CVE-2016-1579 UDM doesn't check for confinement before running post-processing commands

UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UD...