Lomiri Download Manager
Monthly
Incorrect DBus policy in Lomiri Download Manager (lomiri-download-manager on UBports) allows any local user to read arbitrary files as root via the privileged DBus service, resulting in information disclosure. This local privilege escalation vulnerability affects all versions and requires local access to a device running UBports Lomiri/Ubuntu Touch with the service active. No public exploit code or active exploitation has been identified; risk is moderate due to the local-only attack vector.
Incorrect DBus policy in lomiri-download-manager, the download service shipped with Ubuntu Touch (UBports), allows an unprivileged local user to invoke privileged methods on the root-owned system bus service and execute arbitrary commands as root. The affected component is the UBports lomiri-download-manager package across all released versions (CPE cpe:2.3:a:ubports:lomiri-download-manager:*), and exploitation is strictly local: it requires the attacker to already hold an unprivileged account or in-app code execution on the device, with no user interaction needed. Vendor input rates a lower CVSS 3.1 base score of 5.5 (C:H/I:N/A:N, scope unchanged), while independent analysis assesses the correctly scoped vector as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting full root compromise as well as unauthenticated arbitrary file read as root; no public exploit code or confirmed active exploitation was identified at time of analysis.
Incorrect DBus policy in Lomiri Download Manager (lomiri-download-manager on UBports) allows any local user to read arbitrary files as root via the privileged DBus service, resulting in information disclosure. This local privilege escalation vulnerability affects all versions and requires local access to a device running UBports Lomiri/Ubuntu Touch with the service active. No public exploit code or active exploitation has been identified; risk is moderate due to the local-only attack vector.
Incorrect DBus policy in lomiri-download-manager, the download service shipped with Ubuntu Touch (UBports), allows an unprivileged local user to invoke privileged methods on the root-owned system bus service and execute arbitrary commands as root. The affected component is the UBports lomiri-download-manager package across all released versions (CPE cpe:2.3:a:ubports:lomiri-download-manager:*), and exploitation is strictly local: it requires the attacker to already hold an unprivileged account or in-app code execution on the device, with no user interaction needed. Vendor input rates a lower CVSS 3.1 base score of 5.5 (C:H/I:N/A:N, scope unchanged), while independent analysis assesses the correctly scoped vector as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting full root compromise as well as unauthenticated arbitrary file read as root; no public exploit code or confirmed active exploitation was identified at time of analysis.