Information disclosure in Canonical Ubuntu Linux
CVE-2012-0950
The Apport hook (DistUpgradeApport.py) in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0949.
Vulnerability class: Information Disclosure
EPSS: 0.018 (76.0th percentile) — read the EPSS interpretation.
Affected products
- Canonical Ubuntu_linux — versions 11.04, 11.10, 12.04
- N/a — versions n/a
Weakness classification (CWE)
References
- security@ubuntu.com (x_refsource_CONFIRM)
- security@ubuntu.com (x_refsource_UBUNTU, vendor-advisory, Vendor Advisory)