Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Apport
(Apport_project)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 24 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2020-04-22 | CVE-2020-8831 | Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for... | Apport, Ubuntu_linux | 5.5 | ||
| 2020-04-22 | CVE-2020-8833 | Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23,... | Apport, Ubuntu_linux | 4.7 | ||
| 2024-06-04 | CVE-2022-28652 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack | Apport, Ubuntu_linux | 5.5 | ||
| 2024-06-04 | CVE-2022-28654 | is_closing_session() allows users to fill up apport.log | Apport, Ubuntu_linux | 5.5 | ||
| 2024-06-04 | CVE-2022-28655 | is_closing_session() allows users to create arbitrary tcp dbus connections | Apport, Ubuntu_linux | 7.1 | ||
| 2024-06-04 | CVE-2022-28656 | is_closing_session() allows users to consume RAM in the Apport process | Apport, Ubuntu_linux | 5.5 | ||
| 2024-06-04 | CVE-2022-28657 | Apport does not disable python crash handler before entering chroot | Apport, Ubuntu_linux | 7.8 | ||
| 2024-06-04 | CVE-2022-28658 | Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing | Apport, Ubuntu_linux | 5.5 | ||
| 2019-08-29 | CVE-2019-7307 | Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and... | Apport | 7.0 | ||
| 2020-02-08 | CVE-2019-11481 | Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences. | Apport, Ubuntu_linux | 7.8 |