Apport_project Apport
24 CVEs affecting Apport_project Apport. Latest disclosed: 2024-06-04. Critical: 0, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28657 | High | 7.8 | 2024-06-04 | Apport does not disable python crash handler before entering chroot |
CVE-2018-6552 | High | 7.8 | 2018-05-31 | Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage… |
CVE-2017-14180 | High | 7.8 | 2018-02-02 | Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an atta… |
CVE-2017-14179 | High | 7.8 | 2018-02-02 | Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker cou… |
CVE-2017-14177 | High | 7.8 | 2018-02-02 | Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could lev… |
CVE-2017-10708 | High | 7.8 | 2017-07-18 | An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific h… |
CVE-2016-9950 | High | 7.8 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields ar… |
CVE-2016-9949 | High | 7.8 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins wi… |
CVE-2022-28655 | High | 7.1 | 2024-06-04 | is_closing_session() allows users to create arbitrary tcp dbus connections |
CVE-2019-11483 | High | 7.0 | 2020-02-08 | Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privil… |
CVE-2019-7307 | High | 7.0 | 2019-08-29 | Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability… |
CVE-2020-8831 | Medium | 6.5 | 2020-04-22 | Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this i… |
CVE-2016-9951 | Medium | 6.5 | 2016-12-17 | An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This… |
CVE-2020-8833 | Medium | 5.6 | 2020-04-22 | Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs… |
CVE-2022-28658 | Medium | 5.5 | 2024-06-04 | Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing |
CVE-2022-28656 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to consume RAM in the Apport process |
CVE-2022-28654 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to fill up apport.log |
CVE-2022-28652 | Medium | 5.5 | 2024-06-04 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack |
CVE-2019-11482 | Medium | 4.2 | 2020-02-08 | Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary direc… |
CVE-2019-11481 | Low | 3.8 | 2020-02-08 | Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a us… |