CVE-2021-3155

Name	CVE-2021-3155
Description	snapd 2.54.2 and earlier created ~/snap directories in user home directories without specifying owner-only permissions. This could allow a local attacker to read information that should have been private. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
snapd (PTS)	bullseye (security), bullseye	2.49-1+deb11u2	vulnerable
	bookworm	2.57.6-1	fixed
	trixie	2.68.3-3	fixed
	forky, sid	2.71-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
snapd	source	(unstable)	2.54-1

Notes

[bullseye] - snapd <no-dsa> (Minor issue)
[buster] - snapd <no-dsa> (Minor issue)
https://github.com/snapcore/snapd/pull/9841
https://github.com/snapcore/snapd/commit/6bcaeeccd16ed8298a301dd92f6907f88c24cc85 (2.52)
https://github.com/snapcore/snapd/commit/7d2a966620002149891446a53cf114804808dcca (2.54)