CVE-2022-28658 | Medium | 5.5 | 2024-06-04 | Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing |
CVE-2022-28657 | High | 7.8 | 2024-06-04 | Apport does not disable python crash handler before entering chroot |
CVE-2022-28656 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to consume RAM in the Apport process |
CVE-2022-28655 | High | 7.1 | 2024-06-04 | is_closing_session() allows users to create arbitrary tcp dbus connections |
CVE-2022-28654 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to fill up apport.log |
CVE-2022-28652 | Medium | 5.5 | 2024-06-04 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack |
CVE-2019-15790 | Low | 2.8 | 2020-04-28 | Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs t… |
CVE-2020-8833 | Medium | 5.6 | 2020-04-22 | Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs… |
CVE-2020-8831 | Medium | 6.5 | 2020-04-22 | Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this i… |
CVE-2019-11485 | Low | 3.3 | 2020-02-08 | Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling. |
CVE-2019-11483 | High | 7.0 | 2020-02-08 | Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privil… |
CVE-2019-11482 | Medium | 4.2 | 2020-02-08 | Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary direc… |
CVE-2019-11481 | Low | 3.8 | 2020-02-08 | Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a us… |
CVE-2019-7307 | High | 7.0 | 2019-08-29 | Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability… |
CVE-2018-6552 | High | 7.8 | 2018-05-31 | Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage… |
CVE-2017-14180 | High | 7.8 | 2018-02-02 | Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an atta… |
CVE-2017-14179 | High | 7.8 | 2018-02-02 | Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker cou… |
CVE-2017-14177 | High | 7.8 | 2018-02-02 | Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could lev… |
CVE-2017-10708 | High | 7.8 | 2017-07-18 | An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific h… |
CVE-2016-9951 | Medium | 6.5 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This… |
CVE-2016-9950 | High | 7.8 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields ar… |
CVE-2016-9949 | High | 7.8 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins wi… |
CVE-2015-1338 | | | 2015-10-01 | kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2)… |
CVE-2015-1318 | | | 2015-04-17 | The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a n… |