CVE-2017-14179
published 2018-02-02CVE-2017-14179: Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker…
PriorityP337high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.36%
28.1th percentile
Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apport_project | apport | < 2.13 | 2.13 |
| apport_project | apport | >= 0 < 2.14.1-0ubuntu3.27 | 2.14.1-0ubuntu3.27 |
| apport_project | apport | >= 0 < 2.14.1-0ubuntu3.25 | 2.14.1-0ubuntu3.25 |
| apport_project | apport | >= 0 < 2.20.1-0ubuntu2.12 | 2.20.1-0ubuntu2.12 |
| apport_project | apport | 2.13 – 2.20.7 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q2pm-6838-p3jm: Apport 2
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2017-14180 [HIGH] CWE-400 GHSA-q2pm-6838-p3jm: Apport 2
Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, a different vulnerability than CVE-2017-14179.
GHSA
GHSA-6rjw-gqv7-rv3q: Apport before 2
ghsa_unreviewed·2022-05-14
CVE-2017-14179 [HIGH] CWE-400 GHSA-6rjw-gqv7-rv3q: Apport before 2
Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers.
OSV
CVE-2017-14180: Apport 2
osv·2017-11-15·CVSS 7.8
CVE-2017-14180 [HIGH] CVE-2017-14180: Apport 2
Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, a different vulnerability than CVE-2017-14179.
OSV
CVE-2017-14179: Apport before 2
osv·2017-11-15·CVSS 7.8
CVE-2017-14179 [HIGH] CVE-2017-14179: Apport before 2
Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-02-02
Published