Canonical Ltd. Snapd
8 CVEs affecting Canonical Ltd. Snapd. Latest disclosed: 2024-06-21. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-1523 | Critical | 10.0 | 2023-09-01 | Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary co… |
CVE-2020-27352 | Critical | 9.3 | 2024-06-21 | When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move pr… |
CVE-2021-4120 | High | 8.2 | 2022-02-17 | snapd 2.54.2 fails to perform sufficient validation of snap content interface and layout paths, resulting in the ability for snaps to inject arbitrary AppArmor… |
CVE-2024-5138 | High | 8.1 | 2024-05-31 | The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of the snap. It was fo… |
CVE-2022-3328 | High | 7.8 | 2024-01-08 | Race condition in snap-confine's must_mkdir_and_open_with_perms() |
CVE-2021-44731 | High | 7.8 | 2022-02-17 | A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain… |
CVE-2021-44730 | High | 7.8 | 2022-02-17 | snapd 2.54.2 did not properly validate the location of the snap-confine binary. A local attacker who can hardlink this binary to another location to cause snap… |
CVE-2021-3155 | Low | 3.8 | 2022-02-17 | snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to re… |