7.8
Élevée
CVE-2026-8933 A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally…
Description
A local privilege escalation vulnerability exists in snap-confine, a set-capabilities core component used internally by Canonical snapd to construct the secure execution environment for snap applications. This vulnerability uniquely affects versions of snap-confine configured with set-capabilities (rather than standard set-uid-root installations). Due to a flaw in how privilege boundaries or security sandboxes are initialized when the binary runs under limited ambient capabilities, a local, unprivileged attacker can exploit this behavior to bypass intended restrictions and execute arbitrary code. Successful exploitation allows the local user to elevate their privileges to full root authority.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ubuntu 26.04 LTS 2.76 | premières → < 2.76+ubuntu26.04.3 | 2.76+ubuntu26.04.3 |
| Ubuntu 24.04 LTS 2.76 | premières → < 2.76+ubuntu24.04.1 | 2.76+ubuntu24.04.1 |
| Ubuntu 22.04 LTS 2.76 | premières → < 2.76+ubuntu22.04.1 | 2.76+ubuntu22.04.1 |
Références
- ubuntu.com ubuntu.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Ubuntu 26.04 LTS
Les 7 CVE de Ubuntu 26.04 LTS →
CVE-2026-15226
A sandbox confinement bypass vulnerability exists in Canonical snapd within its internal execution environment…
8.4
Élevée
CVE-2024-5300
An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile…
5.6
Moyenne
CVE-2026-12391
An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools)…
5.0
Moyenne
CVE-2026-11386
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools)
9.0
Critique