snap-confine: In snapd versions prior to 2.62, snapd failed to properly check thedestination of symbolic links when extracting a snap

In snapd versions prior to 2.62, snapd failed to properly check thedestination of symbolic links when extracting a snap. The snap formatis a squashfs file-system image and so can contain symbolic links andother file types. Various file entries within the snap squashfs image(such as icons and desktop files etc) are directly read by snapd whenit is extracted. An attacker who could convince a user to install amalicious snap which contained symbolic links at these paths could thencause snapd to write out the contents of the symbolic link destinationinto a world-readable directory. This in-turn could allow an unprivilegeduser to gain access to privileged information.

Where it's fixed