6.7Medium

CVE-2016-1579UDM doesn't check for confinement before running post-processing commands

Ubuntu Ubuntu Download Manager Published: 2019-04-22 18:35 (7 years ago)

Description

UDM provides support for running commands after a download is completed, this is currently made use of for click package installation. This functionality was not restricted to unconfined applications. Before UDM version 1.2+16.04.20160408-0ubuntu1 any confined application could make use of the UDM C++ API to run arbitrary commands in an unconfined environment as the phablet user.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Ubuntu	Ubuntu Download Manager	unspecified – < 1.2+16.04.20160408-0ubuntu1

References and patches

https://bazaar.launchpad.net/~phablet-team/ubuntu-download-manager/trunk/revision/359

CVSS score

6.7Medium

Source: canonical · CVSS 3.0

Attack vector: Local
Attack complexity: High
Privileges required: Low
User interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS (chance of exploitation in 30 days)

0.77%

higher than 56% of all CVEs

Timeline

ID reserved2016-01-12
Published2019-04-22 18:35
Reached IP-DB2026-10-24 23:53
Last updated2024-09-16 19:27

Assigned by (CNA): canonical

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Ubuntu

7.7High

CVE-2026-109518 6 days ago

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

6.5Medium

CVE-2026-121412 7 days ago

FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly

FreeRDP FreeRDP

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending f…

4.3Medium

CVE-2026-121410 7 days ago

FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2

FreeRDP FreeRDP

FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering a…

3.1Low

CVE-2026-121411 7 days ago

FreeRDP before 3.32.2 X11 Client Abort via RDPGFX Scaled Output Geometry

FreeRDP FreeRDP

FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked U…

5.9Medium

CVE-2026-121409 7 days ago

FreeRDP before 3.32.2 Denial of Service via Oversized X.224 Routing Token

FreeRDP FreeRDP

FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU…

6.5Medium

CVE-2026-121407 7 days ago

FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel

FreeRDP FreeRDP

FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an…