CVE-2016-1580
CriticalSummary
The setup_snappy_os_mounts function in the ubuntu-core-launcher package before version 1.0.27.1 improperly determines the mount point of bind mounts when using snaps, which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with 'ubuntu-core.'
Risk Assessment
The organization may be exposed to sensitive data leakage or unauthorized system access through malicious snaps, potentially leading to serious security implications.
Recommendation
It is recommended to update the ubuntu-core-launcher package to version 1.0.27.1 or later to mitigate this vulnerability.
Original NVD description (English source)
The setup_snappy_os_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts when using snaps, which might allow remote attackers to obtain sensitive information or gain privileges via a snap with a name starting with "ubuntu-core."