CVE-2017-10600

ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories...

CVE-2017-10600

CVE-2017-10600 affects ubuntu-image 1.0 (before 2017-07-07). When run as non-root, it creates files in the resulting image with the UID of the invoking user, enabling a local attacker who shares that UID to access cloud-init and snapd directories after boot. This is a local vulnerability with pot...

CVE-2017-10600: Session Fixation

ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories...

PT-2017-11398

Name of the Vulnerable Software and Affected Versions ubuntu-image version 1.0 before 2017-07-07 Description The issue allows a local attacker with the same uid as the image creator to have unintended access to cloud-init and snapd directories when the resulting image is booted. This occurs becau...

Denial Of Service(DoS)

github.com/snapcore/snapd is vulnerable to denial of service DoS attacks. The vulnerability exists because it does not perform enough sanitization when the interface code that is responsible for sanitization of user-controlled plug/slot definition...