Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

apport project apport - vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2015-1318
The crash reporting feature in Apport 2.13 up to and including 2.17.x prior to 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).
Apport Project Apport 2.13.3Apport Project Apport 2.14Apport Project Apport 2.14.1Apport Project Apport 2.15Apport Project Apport 2.15.1Apport Project Apport 2.14.2Apport Project Apport 2.14.3Apport Project Apport 2.16Apport Project Apport 2.16.1Apport Project Apport 2.13.1Apport Project Apport 2.13.2Apport Project Apport 2.14.6Apport Project Apport 2.14.7Apport Project Apport 2.13Apport Project Apport 2.14.4Apport Project Apport 2.14.5Apport Project Apport 2.16.2Apport Project Apport 2.17
6.5
CVSSv3
CVE-2016-9951
An issue exists in Apport prior to 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to...
Apport Project Apport
7.8
CVSSv3
CVE-2017-10708
An issue exists in Apport up to and including 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific hooks without protecting against path traversal. This allows remote malicious users to execute arbitrary code via a cr...
Apport Project Apport
7.8
CVSSv3
CVE-2016-9949
An issue exists in Apport prior to 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote malicious users to execute arbitrary Python code.
Apport Project ApportCanonical Ubuntu Linux
7.8
CVSSv3
CVE-2016-9950
An issue exists in Apport prior to 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory...
Apport Project ApportCanonical Ubuntu Linux
NA
CVE-2015-1338
kernel_crashdump in Apport prior to 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
Apport Project ApportCanonical Ubuntu Linux 14.04Canonical Ubuntu Linux 12.04Canonical Ubuntu Linux 15.04
5.5
CVSSv3
CVE-2020-8831
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using ...
Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 19.10Canonical Ubuntu Linux 16.04Apport Project Apport -
4.7
CVSSv3
CVE-2020-8833
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script...
Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 19.10Canonical Ubuntu Linux 16.04Apport Project Apport -
7.8
CVSSv3
CVE-2017-14177
Apport up to and including 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges. NOTE: this vul...
Apport Project ApportCanonical Ubuntu Linux 17.10Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 17.04Canonical Ubuntu Linux 14.04
7.8
CVSSv3
CVE-2017-14180
Apport 2.13 up to and including 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, ...
Apport Project ApportCanonical Ubuntu Linux 16.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 17.10Canonical Ubuntu Linux 17.04Canonical Ubuntu Linux 14.04
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook