USN-4424-1: snapd vulnerabilities

It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices ran on every boot without restrictions. A physical attacker could exploit this to craft cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intende...

USN-4424-1 snapd vulnerabilities

It was discovered that cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices ran on every boot without restrictions. A physical attacker could exploit this to craft cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intende...

CVE-2020-11933

cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu Core 18 devices was run without restrictions on every boot, which a physical attacker could exploit by crafting cloud-init user-data/meta-data via external media to perform arbitrary changes on the device to bypass intended security...

CVE-2020-11934

It was discovered that snapctl user-open allowed altering the $XDGDATADIRS environment variable when calling the system xdg-open. OpenURL in usersession/userd/launcher.go would alter $XDGDATADIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this t...

UBUNTU-CVE-2020-11934

It was discovered that snapctl user-open allowed altering the $XDGDATADIRS environment variable when calling the system xdg-open. OpenURL in usersession/userd/launcher.go would alter $XDGDATADIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this t...

Fedora 29 : snapd-glib (2019-bc3dfb389f)

Update to v1.48 - New API : - snapdclientgetconnectionsasync - snapdclientgetconnectionsfinish - snapdclientgetconnectionssync - snapdclientgetinterfaces2async - snapdclientgetinterfaces2finish - snapdclientgetinterfaces2sync - snapdclientgetsnapconfasync - snapdclientgetsnapconffinish -...

Fedora 30 : snapd-glib (2019-b6612c5fe5)

Update to v1.48 - New API : - snapdclientgetconnectionsasync - snapdclientgetconnectionsfinish - snapdclientgetconnectionssync - snapdclientgetinterfaces2async - snapdclientgetinterfaces2finish - snapdclientgetinterfaces2sync - snapdclientgetsnapconfasync - snapdclientgetsnapconffinish -...

[SECURITY] Fedora 29 Update: snapd-glib-1.48-1.fc29

snapd-glib is a library that provides an interface to communicate with snapd for GLib based applications...

[SECURITY] Fedora 30 Update: snapd-glib-1.48-1.fc30

snapd-glib is a library that provides an interface to communicate with snapd for GLib based applications...

Fedora Update for snapd-glib FEDORA-2019-bc3dfb389f

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora Update for snapd-glib FEDORA-2019-b6612c5fe5

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Symlink Attack

github.com/snapcore/snapd is vulnerable to symlink attack. A malicious current working directory can be used to bypass permission checks on a multi-user system. The vulnerability can be exploited when snap-confine changes the current working directory and attempts to restore the original working...

Incorrect Ownership Assignment

github.com/snapcore/snapd assigns incorrect ownership to system resources. The ownership of a snap container is set using the uid and gid of the user who first invokes snap-confine. This leads to a vulnerability where the user is granted unauthorized access to modify the private or tmp directory...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass." Remediation Upgrade...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory. Remediation...

CVE-2019-11502

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...

DEBIAN-CVE-2019-11503

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...