CVE catalog

CVE-2020-11934

snapd: CVE-2020-11934

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.36% · Oct 25, 2026

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansnapdsid2.77.1-2fixed
Debiansnapdforky2.77.1-2fixed
Debiansnapdtrixie2.68.3-3+deb13u1fixed
Debiansnapdtrixie-security2.68.3-3+deb13u1fixed
Debiansnapdbookworm2.57.6-1+deb12u1fixed
Debiansnapdbookworm-security2.57.6-1+deb12u1fixed
Ubuntusnapd16.041.9vulnerable
Ubuntusnapd16.041.9.1.1vulnerable
Ubuntusnapd16.041.9.2vulnerable
Ubuntusnapd16.042.0vulnerable
Ubuntusnapd16.042.0.1vulnerable
Ubuntusnapd16.042.0.2vulnerable
Ubuntusnapd16.042.0.3vulnerable
Ubuntusnapd16.042.0.5vulnerable
Ubuntusnapd16.042.0.8vulnerable
Ubuntusnapd16.042.0.9vulnerable
Ubuntusnapd16.042.0.10vulnerable
Ubuntusnapd16.042.11+0.16.04vulnerable
Ubuntusnapd16.042.12+0.16.04vulnerable
Ubuntusnapd16.042.13vulnerable
Ubuntusnapd16.042.14.2~16.04vulnerable
Ubuntusnapd16.042.15.2ubuntu1vulnerable
Ubuntusnapd16.042.16ubuntu3vulnerable
Ubuntusnapd16.042.17.1ubuntu1vulnerable
Ubuntusnapd16.042.20.1ubuntu1vulnerable
Ubuntusnapd16.042.21vulnerable
Ubuntusnapd16.042.22.2vulnerable
Ubuntusnapd16.042.22.3vulnerable
Ubuntusnapd16.042.22.6vulnerable
Ubuntusnapd16.042.23.1vulnerable
Ubuntusnapd16.042.24.1vulnerable
Ubuntusnapd16.042.25vulnerable
Ubuntusnapd16.042.26.10vulnerable
Ubuntusnapd16.042.27.5vulnerable
Ubuntusnapd16.042.28.5vulnerable
Ubuntusnapd16.042.29.4.2vulnerable
Ubuntusnapd16.042.32.3.2vulnerable
Ubuntusnapd16.042.32.9vulnerable
Ubuntusnapd16.042.33.1ubuntu2vulnerable
Ubuntusnapd16.042.34.2vulnerable
Ubuntusnapd16.042.34.2ubuntu0.1vulnerable
Ubuntusnapd16.042.37.4vulnerable
Ubuntusnapd16.042.37.4ubuntu0.1vulnerable
Ubuntusnapd16.042.38vulnerable
Ubuntusnapd16.042.39.2vulnerable
Ubuntusnapd16.042.39.2ubuntu0.2vulnerable
Ubuntusnapd16.042.40vulnerable
Ubuntusnapd16.042.42.1vulnerable
Ubuntusnapd16.042.45.1vulnerable
Ubuntusnapd16.042.45.1ubuntu0.2fixed
Ubuntusnapd18.042.28.5+17.10vulnerable
Ubuntusnapd18.042.29.4.1+18.04vulnerable
Ubuntusnapd18.042.29.4.2+18.04vulnerable
Ubuntusnapd18.042.31.1+18.04vulnerable
Ubuntusnapd18.042.32+18.04~pre5vulnerable
Ubuntusnapd18.042.32+18.04~pre6vulnerable
Ubuntusnapd18.042.32+18.04vulnerable
Ubuntusnapd18.042.32.3.2+18.04vulnerable
Ubuntusnapd18.042.32.5+18.04vulnerable
Ubuntusnapd18.042.32.8+18.04vulnerable
Ubuntusnapd18.042.32.9+18.04vulnerable
Ubuntusnapd18.042.33.1+18.04ubuntu2vulnerable
Ubuntusnapd18.042.34.2+18.04vulnerable
Ubuntusnapd18.042.34.2+18.04.1vulnerable
Ubuntusnapd18.042.37.1+18.04vulnerable
Ubuntusnapd18.042.37.1.1+18.04vulnerable
Ubuntusnapd18.042.37.4+18.04vulnerable
Ubuntusnapd18.042.37.4+18.04.1vulnerable
Ubuntusnapd18.042.38+18.04vulnerable
Ubuntusnapd18.042.39.2+18.04vulnerable
Ubuntusnapd18.042.40+18.04vulnerable
Ubuntusnapd18.042.42.1+18.04vulnerable
Ubuntusnapd18.042.45.1+18.04vulnerable
Ubuntusnapd18.042.45.1+18.04.2fixed
Ubuntusnapd20.042.41+19.10.1vulnerable
Ubuntusnapd20.042.42.1+20.04vulnerable
Ubuntusnapd20.042.43.3+git1.8109f8vulnerable
Ubuntusnapd20.042.44~pre1+20.04vulnerable
Ubuntusnapd20.042.44+20.04vulnerable
Ubuntusnapd20.042.44.2+20.04vulnerable
Ubuntusnapd20.042.44.3+20.04vulnerable
Ubuntusnapd20.042.45.1+20.04vulnerable
Ubuntusnapd20.042.45.1+20.04.2fixed
Ubuntusnapd16.041.9vulnerable
Ubuntusnapd16.041.9.1.1vulnerable
Ubuntusnapd16.041.9.2vulnerable
Ubuntusnapd16.042.0vulnerable
Ubuntusnapd16.042.0.1vulnerable
Ubuntusnapd16.042.0.2vulnerable
Ubuntusnapd16.042.0.3vulnerable
Ubuntusnapd16.042.0.5vulnerable
Ubuntusnapd16.042.0.8vulnerable
Ubuntusnapd16.042.0.9vulnerable
Ubuntusnapd16.042.0.10vulnerable
Ubuntusnapd16.042.11+0.16.04vulnerable
Ubuntusnapd16.042.12+0.16.04vulnerable
Ubuntusnapd16.042.13vulnerable
Ubuntusnapd16.042.14.2~16.04vulnerable
Ubuntusnapd16.042.15.2ubuntu1vulnerable
Ubuntusnapd16.042.16ubuntu3vulnerable
Ubuntusnapd16.042.17.1ubuntu1vulnerable
Ubuntusnapd16.042.20.1ubuntu1vulnerable
Ubuntusnapd16.042.21vulnerable
Ubuntusnapd16.042.22.2vulnerable
Ubuntusnapd16.042.22.3vulnerable
Ubuntusnapd16.042.22.6vulnerable
Ubuntusnapd16.042.23.1vulnerable
Ubuntusnapd16.042.24.1vulnerable
Ubuntusnapd16.042.25vulnerable
Ubuntusnapd16.042.26.10vulnerable
Ubuntusnapd16.042.27.5vulnerable
Ubuntusnapd16.042.28.5vulnerable
Ubuntusnapd16.042.29.4.2vulnerable
Ubuntusnapd16.042.32.3.2vulnerable
Ubuntusnapd16.042.32.9vulnerable
Ubuntusnapd16.042.33.1ubuntu2vulnerable
Ubuntusnapd16.042.34.2vulnerable
Ubuntusnapd16.042.34.2ubuntu0.1vulnerable
Ubuntusnapd16.042.37.4vulnerable
Ubuntusnapd16.042.37.4ubuntu0.1vulnerable
Ubuntusnapd16.042.38vulnerable
Ubuntusnapd16.042.39.2vulnerable
Ubuntusnapd16.042.39.2ubuntu0.2vulnerable
Ubuntusnapd16.042.40vulnerable
Ubuntusnapd16.042.42.1vulnerable
Ubuntusnapd16.042.45.1vulnerable
Ubuntusnapd16.042.45.1ubuntu0.2fixed
Ubuntusnapd18.042.28.5+17.10vulnerable
Ubuntusnapd18.042.29.4.1+18.04vulnerable
Ubuntusnapd18.042.29.4.2+18.04vulnerable
Ubuntusnapd18.042.31.1+18.04vulnerable
Ubuntusnapd18.042.32+18.04~pre5vulnerable
Ubuntusnapd18.042.32+18.04~pre6vulnerable
Ubuntusnapd18.042.32+18.04vulnerable
Ubuntusnapd18.042.32.3.2+18.04vulnerable
Ubuntusnapd18.042.32.5+18.04vulnerable
Ubuntusnapd18.042.32.8+18.04vulnerable
Ubuntusnapd18.042.32.9+18.04vulnerable
Ubuntusnapd18.042.33.1+18.04ubuntu2vulnerable
Ubuntusnapd18.042.34.2+18.04vulnerable
Ubuntusnapd18.042.34.2+18.04.1vulnerable
Ubuntusnapd18.042.37.1+18.04vulnerable
Ubuntusnapd18.042.37.1.1+18.04vulnerable
Ubuntusnapd18.042.37.4+18.04vulnerable
Ubuntusnapd18.042.37.4+18.04.1vulnerable
Ubuntusnapd18.042.38+18.04vulnerable
Ubuntusnapd18.042.39.2+18.04vulnerable
Ubuntusnapd18.042.40+18.04vulnerable
Ubuntusnapd18.042.42.1+18.04vulnerable
Ubuntusnapd18.042.45.1+18.04vulnerable
Ubuntusnapd18.042.45.1+18.04.2fixed
Ubuntusnapd20.042.41+19.10.1vulnerable
Ubuntusnapd20.042.42.1+20.04vulnerable
Ubuntusnapd20.042.43.3+git1.8109f8vulnerable
Ubuntusnapd20.042.44~pre1+20.04vulnerable
Ubuntusnapd20.042.44+20.04vulnerable
Ubuntusnapd20.042.44.2+20.04vulnerable
Ubuntusnapd20.042.44.3+20.04vulnerable
Ubuntusnapd20.042.45.1+20.04vulnerable
Ubuntusnapd20.042.45.1+20.04.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansnapdsourcesid2.45.2-1not yet assignedNot reportedNot reported
Debiansnapdsourceforky2.45.2-1not yet assignedNot reportedNot reported
Debiansnapdsourcetrixie2.45.2-1not yet assignedNot reportedNot reported
Debiansnapdsourcebookworm2.45.2-1not yet assignedNot reportedNot reported
Ubuntusnapddeb16.042.45.1ubuntu0.2Not reportedUSN-4424-1Not reported
Ubuntusnapddeb18.042.45.1+18.04.2Not reportedUSN-4424-1Not reported
Ubuntusnapddeb20.042.45.1+20.04.2Not reportedUSN-4424-1Not reported
Ubuntusnapddeb16.042.45.1ubuntu0.2Not reportedUBUNTU-CVE-2020-11934Not reported
Ubuntusnapddeb18.042.45.1+18.04.2Not reportedUBUNTU-CVE-2020-11934Not reported
Ubuntusnapddeb20.042.45.1+20.04.2Not reportedUBUNTU-CVE-2020-11934Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [golang-github-snapcore-snapd-dev]Unknown

    Source package: [snapd]

    Details (4)

    • 2.57.6-1+deb12u1 · all · bookworm

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · all · bookworm

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

  • [snap-confine]Unknown

    Source package: [snapd]

    Details (4)

    • 2.57.6-1+deb12u1+b2 · amd64 · bookworm

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1+b2 · arm64 · bookworm

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

  • [snapd]Unknown
    Details (4)

    • 2.57.6-1+deb12u1+b2 · amd64 · bookworm

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1+b2 · arm64 · bookworm

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

  • [ubuntu-core-launcher]Unknown

    Source package: [snapd]

    Details (4)

    • 2.57.6-1+deb12u1+b2 · amd64 · bookworm

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1+b2 · arm64 · bookworm

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

    • 2.57.6-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · bookworm; dsa · snapd · debian · 12

[Debian 13 (Trixie)]

  • [golang-github-snapcore-snapd-dev]Unknown

    Source package: [snapd]

    Details (4)

    • 2.68.3-3+deb13u1 · all · trixie

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · all · trixie

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · all · trixie-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

  • [snap-confine]Unknown

    Source package: [snapd]

    Details (4)

    • 2.68.3-3+deb13u1+b6 · amd64 · trixie

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1+b6 · arm64 · trixie

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

  • [snapd]Unknown
    Details (4)

    • 2.68.3-3+deb13u1+b6 · amd64 · trixie

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1+b6 · arm64 · trixie

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

  • [ubuntu-core-launcher]Unknown

    Source package: [snapd]

    Details (4)

    • 2.68.3-3+deb13u1+b6 · amd64 · trixie

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1+b6 · arm64 · trixie

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

    • 2.68.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 2.45.2-1

      dsa · snapd · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]