Skip to content
OpenAdvisories
Medium WID-SEC-2024-1712 3 CVEs

Canonical Snap: Mehrere Schwachstellen

Published Jul 25, 2024 · Updated Jan 12, 2025 · Revision 3 · de-DE

Vendor: Canonical Vendor: Ubuntu Product: Linux Product: snap Platform: Linux

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Canonical Snap ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen und um einen Denial of Service Zustand herbeizuführen.

Product

Snap (auch bekannt als Snappy) ist ein Softwareverteilungssystem und eine Paketverwaltung für Linux.

Vulnerabilities 3

  • Medium 6.3
    CVE-2024-1724

    snapd allows $HOME/bin symlink

    In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a…

    Canonical snap snapd snapd Debian Ubuntu Go
  • Medium 5.8
    CVE-2024-29068

    snapd non-regular file indefinite blocking read

    In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries with…

    Canonical snapd snapd snapd Debian Ubuntu Go
  • Medium 4.8
    CVE-2024-29069

    snapd will follow archived symlinks when unpacking a filesystem

    In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the s…

    Canonical snapd snapd snapd Debian Ubuntu Go

Revision history

  1. #3

    Neue Updates von Ubuntu aufgenommen

  2. #2

    Neue Updates von Ubuntu aufgenommen

  3. #1

    Initiale Fassung

References