Skip to content
CVE PROGRAM SOURCE RECORD6.7 Medium

CVE-2016-1579

UDM doesn't check for confinement before running post-processing commands

Description

UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UDM C++ API to run arbitrary commands in an unconfined environment as the phablet user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ubuntu Ubuntu Download Manager

  • unspecified to < 1.2+16.04.20160408-0ubuntu1affected

References