Unrated severityOSV Advisory· Published Apr 24, 2019· Updated Aug 4, 2024

CVE-2019-11503

Description

snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir() to the current working directory of the calling user, aka a "cwd restore permission bypass."

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Snapcore/SnapdOSV2 versions
1.0-0ubuntu1, 1.0.1-0ubuntu1, 1.1-0ubuntu1, …+ 1 more
- (no CPE)range: 1.0-0ubuntu1, 1.0.1-0ubuntu1, 1.1-0ubuntu1, …
- (no CPE)range: <2.39

Patches

Vulnerability mechanics

References

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6VACEKVQ7UAZ32WO4ZKCFW6YOBSYJ76L/mitrevendor-advisoryx_refsource_FEDORA
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VPU6APEZHAA7N2AI57OT4J2P7NKHFOLM/mitrevendor-advisoryx_refsource_FEDORA
www.openwall.com/lists/oss-security/2019/04/25/7mitremailing-listx_refsource_MLIST
github.com/snapcore/snapd/pull/6642mitrex_refsource_MISC
www.openwall.com/lists/oss-security/2019/04/18/4mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000