CVE-2019-11502

Published: 24 April 2019

snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
snapd Launchpad, Ubuntu, Debian	bionic	Released (2.38+18.04)
	cosmic	Released (2.38+18.10)
	disco	Released (2.38+19.04)
	precise	Does not exist
	trusty	Does not exist (trusty was needs-triage)
	upstream	Released (2.38)
	xenial	Released (2.38)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11502
https://github.com/snapcore/snapd/commit/bdbfeebef03245176ae0dc323392bb0522a339b1
https://www.openwall.com/lists/oss-security/2019/04/18/4
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›