Canonical Ltd. Apport
11 CVEs affecting Canonical Ltd. Apport. Latest disclosed: 2025-01-31. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28657 | High | 7.8 | 2024-06-04 | Apport does not disable python crash handler before entering chroot |
CVE-2022-1242 | High | 7.8 | 2024-06-03 | Apport can be tricked into connecting to arbitrary sockets as the root user |
CVE-2021-3899 | High | 7.8 | 2024-06-03 | There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as roo… |
CVE-2023-1326 | High | 7.7 | 2023-04-13 | A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unpri… |
CVE-2022-28653 | High | 7.5 | 2025-01-31 | Users can consume unlimited disk space in /var/crash |
CVE-2022-28655 | High | 7.1 | 2024-06-04 | is_closing_session() allows users to create arbitrary tcp dbus connections |
CVE-2022-28658 | Medium | 5.5 | 2024-06-04 | Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing |
CVE-2022-28656 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to consume RAM in the Apport process |
CVE-2022-28654 | Medium | 5.5 | 2024-06-04 | is_closing_session() allows users to fill up apport.log |
CVE-2022-28652 | Medium | 5.5 | 2024-06-04 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack |
CVE-2020-11936 | Low | 3.1 | 2025-01-31 | gdbus setgid privilege escalation |