EUVD-2020-4271

Malware in sbrugna...

snapctl Privilege Escalation

The vulnerability of the snapctl utility for managing self-contained packages related to improper analysis of command-line arguments. This allows unprivileged users to initiate authorized actions on behalf of snap. Exploiting this vulnerability can enable a malicious actor to gain increased...

CVE-2020-11934

It was discovered that snapctl user-open allowed altering the $XDGDATADIRS environment variable when calling the system xdg-open. OpenURL in usersession/userd/launcher.go would alter $XDGDATADIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this t...