CVE-2025-5467

published 2025-12-10

CVE-2025-5467: It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership…

Priority P4 11 low 3.3 CVSS 3.1

AV L AC L PR L UI N S U C L I N A N

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
canonical	apport	>= 2.20.1 < 2.20.1-0ubuntu2.30+esm5	2.20.1-0ubuntu2.30+esm5
canonical	apport	>= 2.20.1-0ubuntu1 < 2.20.1-0ubuntu2.30	2.20.1-0ubuntu2.30
canonical	apport	>= 2.20.11-0ubuntu27 < 2.20.11-0ubuntu27.28	2.20.11-0ubuntu27.28
canonical	apport	>= 2.20.11-0ubuntu82 < 2.20.11-0ubuntu82.7	2.20.11-0ubuntu82.7
canonical	apport	>= 2.20.9 < 2.20.9-0ubuntu7.29+esm1	2.20.9-0ubuntu7.29+esm1
canonical	apport	>= 2.20.9-0ubuntu7 < 2.20.9-0ubuntu7.29	2.20.9-0ubuntu7.29
canonical	apport	>= 2.28.1 < 2.28.1-0ubuntu3.6	2.28.1-0ubuntu3.6
canonical	apport	>= 2.28.1-0ubuntu1 < 2.28.1-0ubuntu3.6	2.28.1-0ubuntu3.6
canonical	apport	>= 2.32.0 < 2.32.0-0ubuntu5.1	2.32.0-0ubuntu5.1
canonical	apport	>= 2.32.0-0ubuntu1 < 2.32.0-0ubuntu5.1	2.32.0-0ubuntu5.1
canonical	apport	>= 2.33.0 < 2.33.0-0ubuntu1	2.33.0-0ubuntu1

CVSS provenance

nvd v3.1 3.3 LOW CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvd v4.0 1.9 LOW CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-708