* SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open
(xdg-open)
- usersession/userd/launcher.go: remove XDG_DATA_DIRS environment
variable modification when calling the system xdg-open. Patch
thanks to James Henstridge
- packaging/ubuntu-16.04/snapd.postinst: kill userd on upgrade so it
may autostart on next use. Patch thanks to Michael Vogt
- CVE-2020-11934
- LP: #1880085
This bug was fixed in the package snapd - 2.45.1ubuntu0.2
---------------
snapd (2.45.1ubuntu0.2) xenial-security; urgency=medium
* SECURITY UPDATE: sandbox escape vulnerability via snapctl user-open userd/launcher. go: remove XDG_DATA_DIRS environment ubuntu- 16.04/snapd. postinst: kill userd on upgrade so it
(xdg-open)
- usersession/
variable modification when calling the system xdg-open. Patch
thanks to James Henstridge
- packaging/
may autostart on next use. Patch thanks to Michael Vogt
- CVE-2020-11934
- LP: #1880085
-- Emilia Torino <email address hidden> Fri, 10 Jul 2020 10:40:52 -0300