EUVD-2020-4271

Malware in sbrugna...

The vulnerability of the snapctl utility component for managing self-contained packages related to incorrect input validation allows a malicious actor to escalate their privileges.

The vulnerability of the snapctl utility for managing self-contained packages related to improper analysis of command-line arguments. This allows unprivileged users to initiate authorized actions on behalf of snap. Exploiting this vulnerability can enable a malicious actor to gain increased...

CVE-2020-11934

It was discovered that snapctl user-open allowed altering the $XDGDATADIRS environment variable when calling the system xdg-open. OpenURL in usersession/userd/launcher.go would alter $XDGDATADIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this t...