High severity7.8NVD Advisory· Published Dec 17, 2016· Updated May 6, 2026

CVE-2016-9949

Description

An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code.

Affected products

Apport Project/Apport
cpe:2.3:a:apport_project:apport:*:*:*:*:*:*:*:*
Range: <=2.20.3
Canonical/Ubuntu Linux
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*
Range: <=12.10

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

bugs.launchpad.net/apport/+bug/1648806nvdIssue TrackingPatch
donncha.is/2016/12/compromising-ubuntu-desktop/nvdExploitTechnical DescriptionThird Party Advisory
www.securityfocus.com/bid/95011nvdThird Party AdvisoryVDB Entry
www.ubuntu.com/usn/USN-3157-1nvd
www.exploit-db.com/exploits/40937/nvd

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.008
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000