Apport
by Ubuntu
CVEs (34)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-28654 | Med | 0.36 | 5.5 | 0.00 | Jun 4, 2024 | is_closing_session() allows users to fill up apport.log | ||
| CVE-2022-28652 | Med | 0.36 | 5.5 | 0.00 | Jun 4, 2024 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack | ||
| CVE-2020-15701 | Med | 0.36 | 5.5 | 0.00 | Aug 6, 2020 | An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in… | ||
| CVE-2020-8833 | Med | 0.36 | 5.6 | 0.00 | Apr 22, 2020 | Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron… | ||
| CVE-2025-5054 | Med | 0.31 | 4.7 | 0.01 | May 30, 2025 | Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a… | ||
| CVE-2019-11482 | Med | 0.27 | 4.2 | 0.00 | Feb 8, 2020 | Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories. | ||
| CVE-2021-32556 | Low | 0.25 | 3.8 | 0.00 | Jun 12, 2021 | It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call. | ||
| CVE-2019-11481 | Low | 0.25 | 3.8 | 0.00 | Feb 8, 2020 | Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences. | ||
| CVE-2019-11485 | Low | 0.21 | 3.3 | 0.00 | Feb 8, 2020 | Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling. | ||
| CVE-2019-15790 | Low | 0.18 | 2.8 | 0.01 | Apr 28, 2020 | Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged user could exploit this to read… | ||
| CVE-2015-1338 | 0.03 | — | 0.01 | Oct 1, 2015 | kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log. | |||
| CVE-2023-1326 | Hig | 0.00 | 7.7 | 0.01 | Apr 13, 2023 | A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local… | ||
| CVE-2013-1067 | 0.00 | — | 0.00 | Oct 25, 2013 | Apport 2.12.5 and earlier uses weak permissions for core dump files created by setuid binaries, which allows local users to obtain sensitive information by reading the file. | |||
| CVE-2009-1295 | 0.00 | — | 0.00 | Apr 30, 2009 | Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10, and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files from the application's crash-report directory, which allows local users to delete arbitrary files via unspecified vectors. |
- risk 0.36cvss 5.5epss 0.00
is_closing_session() allows users to fill up apport.log
- risk 0.36cvss 5.5epss 0.00
~/.config/apport/settings parsing is vulnerable to "billion laughs" attack
- risk 0.36cvss 5.5epss 0.00
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in…
- risk 0.36cvss 5.6epss 0.00
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron…
- risk 0.31cvss 4.7epss 0.01
Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a…
- risk 0.27cvss 4.2epss 0.00
Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.
- risk 0.25cvss 3.8epss 0.00
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
- risk 0.25cvss 3.8epss 0.00
Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.
- risk 0.21cvss 3.3epss 0.00
Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.
- risk 0.18cvss 2.8epss 0.01
Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged user could exploit this to read…
- CVE-2015-1338Oct 1, 2015risk 0.03cvss —epss 0.01
kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
- risk 0.00cvss 7.7epss 0.01
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local…
- CVE-2013-1067Oct 25, 2013risk 0.00cvss —epss 0.00
Apport 2.12.5 and earlier uses weak permissions for core dump files created by setuid binaries, which allows local users to obtain sensitive information by reading the file.
- CVE-2009-1295Apr 30, 2009risk 0.00cvss —epss 0.00
Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10, and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files from the application's crash-report directory, which allows local users to delete arbitrary files via unspecified vectors.
Page 2 of 2