CVE-2024-29068

MEDIUM Year: 2024
CVSS v3 Score
6.6
Medium
Weakness Type
CWE-20
View all →

Vulnerability Description

In snapd versions prior to 2.62, snapd failed to properly check the file type when extracting a snap. The snap format is a squashfs file-system image and so can contain files that are non-regular files (such as pipes or sockets etc). Various file entries within the snap squashfs image (such as icons etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained non-regular files at these paths could then cause snapd to block indefinitely trying to read from such files and cause a denial of service.

Related Vulnerabilities

CVE-2016-5025

MEDIUM
CVSS:6.6(Medium)

For the NVIDIA Quadro, NVS, and GeForce products, improper sanitization of parameters in the NVAPI support layer causes a denial of service vulnerability (blue screen crash) within the NVIDIA Windows ...

CWE-202016

CVE-2016-9587

MEDIUM
CVSS:6.6(Medium)

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed b...

CWE-202016

CVE-2017-11885

MEDIUM
CVSS:6.6(Medium)

Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 ...

CWE-202017

CVE-2017-16538

MEDIUM
CVSS:6.6(Medium)

drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified othe...

CWE-202017

CVE-2017-7154

MEDIUM
CVSS:6.6(Medium)

An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. The issue involves the "Kernel" component. It allows loc...

CWE-202017

CVE-2018-1999018

MEDIUM
CVSS:6.6(Medium)

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow($nodeObject) t...

CWE-202018