Canonical Apport vulnerabilities

CVE-2022-1242 [HIGH] CWE-20 CVE-2022-1242: Apport can be tricked into connecting to arbitrary sockets as the root user Apport can be tricked into connecting to arbitrary sockets as the root user

CVE-2021-3899 [HIGH] CWE-367 CVE-2021-3899: There is a race condition in the 'replaced executable' detection that, with the correct local config There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.

CVE-2023-1326 [HIGH] CWE-269 CVE-2023-1326: A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-202 A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrat

CVE-2019-11481 [HIGH] CWE-59 CVE-2019-11481: Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated p Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.

CVE-2015-1341 [HIGH] CWE-264 CVE-2015-1341: Any Python module in sys.path can be imported if the command line of the process triggering the core Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.

CVE-2020-15702 [HIGH] CWE-367 CVE-2020-15702: TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and exe TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior t

CVE-2021-25684 [HIGH] CWE-20 CVE-2021-25684: It was discovered that apport in data/apport did not properly open a report file to prevent hanging It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.

CVE-2021-25682 [HIGH] CWE-20 CVE-2021-25682: It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/p It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.

CVE-2021-25683 [HIGH] CWE-20 CVE-2021-25683: It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/ It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.

CVE-2022-28653 [HIGH] CVE-2022-28653: Users can consume unlimited disk space in /var/crash Users can consume unlimited disk space in /var/crash

CVE-2021-32557 [HIGH] CWE-59 CVE-2021-32557: It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary f It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.

CVE-2020-8831 [MEDIUM] CWE-379 CVE-2020-8831: Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker w

CVE-2021-3709 [MEDIUM] CWE-538 CVE-2021-3709: Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into ex Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.

CVE-2021-3710 [MEDIUM] CWE-24 CVE-2021-3710: An information disclosure via path traversal was discovered in apport/hookutils.py function read_fil An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.2

CVE-2020-8833 [MEDIUM] CWE-367 CVE-2020-8833: Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport al Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the de

CVE-2021-32549 [MEDIUM] CWE-59 CVE-2021-32549: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.

CVE-2021-32551 [MEDIUM] CWE-59 CVE-2021-32551: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.

CVE-2021-32555 [MEDIUM] CWE-59 CVE-2021-32555: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users.

CVE-2025-5054 [MEDIUM] CWE-362 CVE-2025-5054: Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensit Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to

CVE-2019-11482 [MEDIUM] CWE-367 CVE-2019-11482: Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.