Information disclosure in Canonical Ubuntu Linux

CVE-2012-0949

The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report.

Vulnerability class: Information Disclosure

EPSS: 0.021 (79.9th percentile) — read the EPSS interpretation.

Affected products

Canonical Ubuntu_linux — versions 11.04, 11.10, 12.04
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

security@ubuntu.com (vdb-entry, x_refsource_XF)
security@ubuntu.com (x_refsource_UBUNTU, vendor-advisory, Vendor Advisory)
security@ubuntu.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
security@ubuntu.com (x_refsource_OSVDB, vdb-entry)
security@ubuntu.com (vdb-entry, x_refsource_BID)