[SECURITY] Fedora 30 Update: snapd-glib-1.48-1.fc30

snapd-glib is a library that provides an interface to communicate with snapd for GLib based applications...

Fedora Update for snapd-glib FEDORA-2019-bc3dfb389f

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora Update for snapd-glib FEDORA-2019-b6612c5fe5

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Symlink Attack

github.com/snapcore/snapd is vulnerable to symlink attack. A malicious current working directory can be used to bypass permission checks on a multi-user system. The vulnerability can be exploited when snap-confine changes the current working directory and attempts to restore the original working...

Incorrect Ownership Assignment

github.com/snapcore/snapd assigns incorrect ownership to system resources. The ownership of a snap container is set using the uid and gid of the user who first invokes snap-confine. This leads to a vulnerability where the user is granted unauthorized access to modify the private or tmp directory...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory. Remediation...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass." Remediation Upgrade...

CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

DEBIAN-CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

UBUNTU-CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

DEBIAN-CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

CVE-2019-11503

CVE-2019-11503 concerns the snap-confine component included in snapd before 2.39, where a symlink race during a chdir() to the caller’s CWD could enable a cwd restore permission bypass. The vulnerability is documented in multiple sources (NVD, OSV) with the same description. The risk context indi...

CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

CVE-2019-11502

CVE-2019-11502 concerns snap-confine in snapd before 2.38, where ownership of a snap application's resources could be set to the UID/GID of the first calling user. This allowed that user to access a private /tmp directory, a local authority issue that attackers could exploit to modify or read tra...

DEBIAN-CVE-2019-7304

Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1...

CVE-2019-7304

Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1...