CVE-2020-15703
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2020
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
aptdaemon allows unprivileged users to test for the presence of local files via the transaction Locale property
There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
aptdaemon
- Vendor
- Canonical
- Product
- aptdaemon
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| unspecified | affected | custom | 1.1.1+bzr982-0ubuntu32.2 | Unavailable | None listed |
| unspecified | affected | custom | 1.1.1+bzr982-0ubuntu19.4 | Unavailable | None listed |
| unspecified | affected | custom | 1.1.1+bzr982-0ubuntu14.4 | Unavailable | None listed |