CVE-2021-32554
published 2021-06-12CVE-2021-32554: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.29%
20.9th percentile
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apport_project | apport | >= 0 < 2.20.9-0ubuntu7.24 | 2.20.9-0ubuntu7.24 |
| apport_project | apport | >= 0 < 2.20.11-0ubuntu27.18 | 2.20.11-0ubuntu27.18 |
| apport_project | apport | >= 0 < 2.14.1-0ubuntu3.29+esm7 | 2.14.1-0ubuntu3.29+esm7 |
| apport_project | apport | >= 0 < 2.20.1-0ubuntu2.30+esm1 | 2.20.1-0ubuntu2.30+esm1 |
| canonical | apport | >= 2.14.1-0ubuntu3 < 2.14.1-0ubuntu3.29+esm7 | 2.14.1-0ubuntu3.29+esm7 |
| canonical | apport | >= 2.20.1 < 2.20.1-0ubuntu2.30+esm1 | 2.20.1-0ubuntu2.30+esm1 |
| canonical | apport | >= 2.20.11-0ubuntu27 < 2.20.11-0ubuntu27.18 | 2.20.11-0ubuntu27.18 |
| canonical | apport | >= 2.20.11-0ubuntu50 < 2.20.11-0ubuntu50.7 | 2.20.11-0ubuntu50.7 |
| canonical | apport | >= 2.20.11-0ubuntu65 < 2.20.11-0ubuntu65.1 | 2.20.11-0ubuntu65.1 |
| canonical | apport | >= 2.20.9 < 2.20.9-0ubuntu7.24 | 2.20.9-0ubuntu7.24 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q89m-78v7-wxvj: It was discovered that read_file() in apport/hookutils
ghsa_unreviewed·2022-05-24
CVE-2021-32554 [MEDIUM] CWE-59 GHSA-q89m-78v7-wxvj: It was discovered that read_file() in apport/hookutils
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.
OSV
CVE-2021-32554: It was discovered that read_file() in apport/hookutils
osv·2021-05-25·CVSS 5.5
CVE-2021-32554 [MEDIUM] CVE-2021-32554: It was discovered that read_file() in apport/hookutils
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.
Ubuntu
Apport vulnerabilities
vendor_ubuntu·2021-05-25
CVE-2021-32549 Apport vulnerabilities
Title: Apport vulnerabilities
Summary: Several security issues were fixed in Apport.
Maik Münch discovered that Apport incorrectly handled certain information
gathering operations. A local attacker could use these issues to read and
write arbitrary files as an administrator, and possibly escalate
privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Apport vulnerabilities
vendor_ubuntu·2021-05-25
CVE-2021-32549 Apport vulnerabilities
Title: Apport vulnerabilities
Summary: Several security issues were fixed in Apport.
USN-4965-1 fixed several vulnerabilities in Apport. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Maik Münch discovered that Apport incorrectly handled certain information
gathering operations. A local attacker could use these issues to read and
write arbitrary files as an administrator, and possibly escalate
privileges.
Instructions: In general, a standard system update will make all the necessary changes.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-06-12
Published