CVE-2017-10600

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

ubuntu-image 1.0 before 2017-07-07, when invoked as non-root, creates files in the resulting image with the uid of the invoking user. When the resulting image is booted, a local attacker with the same uid as the image creator has unintended access to cloud-init and snapd directories.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://forum.snapcraft.io/t/ownership-bug-in-ubuntu-image/1285Third Party Advisory
https://forum.snapcraft.io/t/ownership-bug-in-ubuntu-image/1285Third Party Advisory

Timeline

Published: Jul 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-106019.8A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a CVE-2017-106027.8A buffer overflow vulnerability in Junos OS CLI may allow a local authenticated user with read only privileges and access to Junos CLI, to e CVE-2017-106037.8An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as th CVE-2017-106045.3When the device is configured to perform account lockout with a defined period of time, any unauthenticated user attempting to log in as roo CVE-2017-106057.5On all vSRX and SRX Series devices, when the DHCP or DHCP relay is configured, specially crafted packet might cause the flowd process to cra CVE-2017-106064.4Version 4.40 of the TPM (Trusted Platform Module) firmware on Juniper Networks SRX300 Series has a weakness in generating cryptographic keys CVE-2017-106077.5Juniper Networks Junos OS 16.1R1, and services releases based off of 16.1R1, are vulnerable to the receipt of a crafted BGP Protocol Data Un CVE-2017-106087.5Any Juniper Networks SRX series device with one or more ALGs enabled may experience a flowd crash when traffic is processed by the Sun/MS-RP CVE-2017-106105.9On SRX Series devices, a crafted ICMP packet embedded within a NAT64 IPv6 to IPv4 tunnel may cause the flowd process to crash. Repeated cras CVE-2017-106115.9If extended statistics are enabled via 'set chassis extended-statistics', when executing any operation that fetches interface statistics, in CVE-2017-106128.0A persistent site scripting vulnerability in Juniper Networks Junos Space allows users who can change certain configuration to implant malic CVE-2017-106135.5A vulnerability in a specific loopback filter action command, processed in a specific logical order of operation, in a running configuration