CVE-2020-11934

It was discovered that snapctl user-open allowed altering the $XDG_DATA_DIRS environment variable when calling the system xdg-open. OpenURL() in usersession/userd/launcher.go would alter $XDG_DATA_DIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this to bypass intended access restrictions to control how the host system xdg-open script opens the URL and, for example, execute a script shipped with the snap without confinement. This issue did not affect Ubuntu Core systems. Fixed in snapd versions 2.45.1ubuntu0.2, 2.45.1+18.04.2 and 2.45.1+20.04.2.

• CWE-668

• https://launchpad.net/bugs/1880085Third Party Advisory
• https://ubuntu.com/USN-4424-1Vendor Advisory
• https://launchpad.net/bugs/1880085Third Party Advisory
• https://ubuntu.com/USN-4424-1Vendor Advisory

Published

Jul 29, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11928In the media-library-assistant plugin before 2.82 for WordPr…9.8
• CVE-2020-1193<p>A remote code execution vulnerability exists in Microsoft…7.8
• CVE-2020-11930The GTranslate plugin before 2.8.52 for WordPress has Reflec…6.1
• CVE-2020-11931An Ubuntu-specific modification to Pulseaudio to provide sec…3.3
• CVE-2020-11932It was discovered that the Subiquity installer for Ubuntu Se…2.3
• CVE-2020-11933cloud-init as managed by snapd on Ubuntu Core 16 and Ubuntu …6.8
• CVE-2020-11935It was discovered that aufs improperly managed inode referen…5.5
• CVE-2020-11936gdbus setgid privilege escalation3.1
• CVE-2020-11937In whoopsie, parse_report() from whoopsie.c allows a local a…5.5
• CVE-2020-11938In JetBrains TeamCity 2018.2 through 2019.2.1, a project adm…4.9
• CVE-2020-11939In nDPI through 3.2 Stable, the SSH protocol dissector has m…9.8
• CVE-2020-1194A denial of service vulnerability exists when Windows Regist…5.5