Vulnerability in Apport Project
CVE-2016-9951
An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the Relaunch button on Apport crash files generated by local systems. The Relaunch button will be hidden when crash files are opened directly in Apport-GTK.
EPSS: 0.067 (93.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
Affected products
- Apport_project Apport
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC, Issue Tracking)
- cve@mitre.org (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Patch, x_refsource_MISC, Issue Tracking)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory)
- cve@mitre.org (exploit, x_refsource_EXPLOIT-DB)
Frequently asked questions
- What is CVE-2016-9951?
- CVE-2016-9951 is a medium-severity vulnerability in Apport Project, classified under Improper Access Control. CVSS score: 6.5/10. Published 2016-12-17.
- How severe is CVE-2016-9951?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2016-9951 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.