CVE-2025-5467

published 2025-12-10

CVE-2025-5467: It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership…

low 1.9 CVSS 4.0

AV L AC L AT N PR L UI N VC L VI N VA N SC N SI N SA N E P CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
canonical	apport	>= 2.20.1 < 2.20.1-0ubuntu2.30+esm5	2.20.1-0ubuntu2.30+esm5
canonical	apport	>= 2.20.1-0ubuntu1 < 2.20.1-0ubuntu2.30	2.20.1-0ubuntu2.30
canonical	apport	>= 2.20.11-0ubuntu27 < 2.20.11-0ubuntu27.28	2.20.11-0ubuntu27.28
canonical	apport	>= 2.20.11-0ubuntu82 < 2.20.11-0ubuntu82.7	2.20.11-0ubuntu82.7
canonical	apport	>= 2.20.9 < 2.20.9-0ubuntu7.29+esm1	2.20.9-0ubuntu7.29+esm1
canonical	apport	>= 2.20.9-0ubuntu7 < 2.20.9-0ubuntu7.29	2.20.9-0ubuntu7.29
canonical	apport	>= 2.28.1 < 2.28.1-0ubuntu3.6	2.28.1-0ubuntu3.6
canonical	apport	>= 2.28.1-0ubuntu1 < 2.28.1-0ubuntu3.6	2.28.1-0ubuntu3.6
canonical	apport	>= 2.32.0 < 2.32.0-0ubuntu5.1	2.32.0-0ubuntu5.1
canonical	apport	>= 2.32.0-0ubuntu1 < 2.32.0-0ubuntu5.1	2.32.0-0ubuntu5.1
canonical	apport	>= 2.33.0 < 2.33.0-0ubuntu1	2.33.0-0ubuntu1

CWE-708