What’s Vulnerable › Vulnerabilities

CVE-2016-1587

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-04-22 · updated 2026-06-17
• Weakness: CWE-284

Description

The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store, potentially using system resources without permission from the legitimate administrator of the system.

Affected products

• Ubuntu snapweb: before 0.21.2 — fixed in 0.21.2

How to fix

Upgrade to a fixed version: Ubuntu snapweb 0.21.2. Check the vendor advisory for mitigations.

References

• https://github.com/snapcore/snapweb/commit/3f4cf9403f7687fbc8e27c0e01b2cf6aa5e7e0d5
• https://github.com/snapcore/snapweb/commit/3f4cf9403f7687fbc8e27c0e01b2cf6aa5e7e0d5

Get alerted when CVE-2016-1587 or the next vulnerability affects your stack