Apport
by Canonical
CVEs (17)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-25684 | Hig | 0.57 | 8.8 | 0.01 | Jun 11, 2021 | It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. | ||
| CVE-2021-25683 | Hig | 0.57 | 8.8 | 0.00 | Jun 11, 2021 | It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel. | ||
| CVE-2021-25682 | Hig | 0.57 | 8.8 | 0.00 | Jun 11, 2021 | It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel. | ||
| CVE-2022-1242 | Hig | 0.51 | 7.8 | 0.00 | Jun 3, 2024 | Apport can be tricked into connecting to arbitrary sockets as the root user | ||
| CVE-2021-3899 | Hig | 0.51 | 7.8 | 0.00 | Jun 3, 2024 | There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root. | ||
| CVE-2022-28653 | Hig | 0.49 | 7.5 | 0.00 | Jan 31, 2025 | Users can consume unlimited disk space in /var/crash | ||
| CVE-2015-1341 | Hig | 0.48 | 7.4 | 0.00 | Apr 22, 2019 | Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path. | ||
| CVE-2020-15702 | Hig | 0.46 | 7.0 | 0.01 | Aug 6, 2020 | TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to… | ||
| CVE-2021-3710 | Med | 0.42 | 6.5 | 0.00 | Oct 1, 2021 | An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26;… | ||
| CVE-2021-3709 | Med | 0.42 | 6.5 | 0.00 | Oct 1, 2021 | Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2;… | ||
| CVE-2020-15701 | Med | 0.36 | 5.5 | 0.00 | Aug 6, 2020 | An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in… | ||
| CVE-2021-32557 | Med | 0.34 | 5.2 | 0.00 | Jun 12, 2021 | It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks. | ||
| CVE-2025-5054 | Med | 0.31 | 4.7 | 0.01 | May 30, 2025 | Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a… | ||
| CVE-2021-32556 | Low | 0.25 | 3.8 | 0.00 | Jun 12, 2021 | It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call. | ||
| CVE-2025-5467 | Low | 0.21 | 3.3 | 0.00 | Dec 10, 2025 | It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups. | ||
| CVE-2020-11936 | Low | 0.20 | 3.1 | 0.00 | Jan 31, 2025 | gdbus setgid privilege escalation | ||
| CVE-2023-1326 | Hig | 0.00 | 7.7 | 0.01 | Apr 13, 2023 | A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local… |
- risk 0.57cvss 8.8epss 0.01
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.
- risk 0.57cvss 8.8epss 0.00
It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.
- risk 0.57cvss 8.8epss 0.00
It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.
- risk 0.51cvss 7.8epss 0.00
Apport can be tricked into connecting to arbitrary sockets as the root user
- risk 0.51cvss 7.8epss 0.00
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.
- risk 0.49cvss 7.5epss 0.00
Users can consume unlimited disk space in /var/crash
- risk 0.48cvss 7.4epss 0.00
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.
- risk 0.46cvss 7.0epss 0.01
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to…
- risk 0.42cvss 6.5epss 0.00
An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26;…
- risk 0.42cvss 6.5epss 0.00
Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2;…
- risk 0.36cvss 5.5epss 0.00
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in…
- risk 0.34cvss 5.2epss 0.00
It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.
- risk 0.31cvss 4.7epss 0.01
Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a…
- risk 0.25cvss 3.8epss 0.00
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
- risk 0.21cvss 3.3epss 0.00
It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.
- risk 0.20cvss 3.1epss 0.00
gdbus setgid privilege escalation
- risk 0.00cvss 7.7epss 0.01
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local…