Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Apport
(Apport_project)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 24 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-06-04 | CVE-2022-28657 | Apport does not disable python crash handler before entering chroot | Apport, Ubuntu_linux | 7.8 | ||
| 2024-06-04 | CVE-2022-28652 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack | Apport, Ubuntu_linux | 5.5 | ||
| 2024-06-04 | CVE-2022-28654 | is_closing_session() allows users to fill up apport.log | Apport, Ubuntu_linux | 5.5 | ||
| 2024-06-04 | CVE-2022-28655 | is_closing_session() allows users to create arbitrary tcp dbus connections | Apport, Ubuntu_linux | 7.1 | ||
| 2024-06-04 | CVE-2022-28656 | is_closing_session() allows users to consume RAM in the Apport process | Apport, Ubuntu_linux | 5.5 | ||
| 2024-06-04 | CVE-2022-28658 | Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing | Apport, Ubuntu_linux | 5.5 | ||
| 2019-08-29 | CVE-2019-7307 | Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and... | Apport | 7.0 | ||
| 2020-02-08 | CVE-2019-11481 | Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences. | Apport, Ubuntu_linux | 7.8 | ||
| 2020-04-28 | CVE-2019-15790 | Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged user could exploit this to read information about a privileged running process by exploiting PID recycling. This information could then be used to obtain ASLR offsets for a process with an existing memory corruption vulnerability. The initial fix introduced... | Apport, Ubuntu_linux | 3.3 | ||
| 2020-04-22 | CVE-2020-8831 | Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for... | Apport, Ubuntu_linux | 5.5 |