Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
60 results · page 1 of 2
Aug 20, 2026Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with thCVE-2026-77113 · Other software · Canonical · reported by security@ubuntu.comMedium 6.7
Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlaunchpad.net
Mar 10, 2026IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontrolleCVE-2026-2713 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.4
IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontrolled search path element vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system.
- Product
- Trusteer Rapport installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 10, 2025It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possiblyCVE-2025-5467 · Other software · Canonical · reported by security@ubuntu.comLow 1.9
It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netstratascale.com
May 30, 2025Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces.CVE-2025-5054 · Other software · Canonical · reported by security@ubuntu.comMedium 4.7
Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1).
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2025gdbus setgid privilege escalationCVE-2020-11936 · Other software · Canonical Ltd. · reported by security@ubuntu.comLow 3.1
gdbus setgid privilege escalation
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.org
Jan 30, 2025Users can consume unlimited disk space in /var/crashCVE-2022-28653 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.5
Users can consume unlimited disk space in /var/crash
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofingCVE-2022-28658 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024Apport does not disable python crash handler before entering chrootCVE-2022-28657 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.8
Apport does not disable python crash handler before entering chroot
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024is_closing_session() allows users to consume RAM in the Apport processCVE-2022-28656 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
is_closing_session() allows users to consume RAM in the Apport process
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024is_closing_session() allows users to create arbitrary tcp dbus connectionsCVE-2022-28655 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.1
is_closing_session() allows users to create arbitrary tcp dbus connections
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024is_closing_session() allows users to fill up apport.logCVE-2022-28654 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
is_closing_session() allows users to fill up apport.log
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024~/.config/apport/settings parsing is vulnerable to "billion laughs" attackCVE-2022-28652 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
~/.config/apport/settings parsing is vulnerable to "billion laughs" attack
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024Apport can be tricked into connecting to arbitrary sockets as the root userCVE-2022-1242 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.8
Apport can be tricked into connecting to arbitrary sockets as the root user
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 3, 2024There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as rootCVE-2021-3899 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.8
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netubuntu.com
Apr 13, 2023A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604.CVE-2023-1326 · Other software · Canonical Ltd. · reported by security@ubuntu.comHigh 7.7
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2021An information disclosure via path traversal was discovered in apport/hookutils.py function read_file().CVE-2021-3710 · Other software · Canonical · reported by security@ubuntu.comMedium 6.5
An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.mitre.org
Sep 30, 2021Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file.CVE-2021-3709 · Other software · Canonical · reported by security@ubuntu.comMedium 6.5
Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.mitre.org
Jun 12, 2021It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.CVE-2021-32557 · Other software · Canonical · reported by security@ubuntu.comMedium 5.2
It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would cCVE-2021-32556 · Other software · Canonical · reported by security@ubuntu.comLow 3.8
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32555 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32554 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32553 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32552 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32551 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32550 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32549 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32548 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 12, 2021It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs.CVE-2021-32547 · Other software · Canonical · reported by security@ubuntu.comHigh 7.3
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 10, 2021It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.CVE-2021-25684 · Other software · Canonical · reported by security@ubuntu.comHigh 8.8
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netseclists.org
Jun 10, 2021It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.CVE-2021-25683 · Other software · Canonical · reported by security@ubuntu.comHigh 8.8
It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Jun 10, 2021It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.CVE-2021-25682 · Other software · Canonical · reported by security@ubuntu.comHigh 8.8
It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Aug 24, 2020IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buffer overflow that woCVE-2018-1985 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.4
IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buffer overflow that would result in a kernel panic. IBM X-Force ID: 154207.
- Product
- Security Trusteer Rapport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Aug 6, 2020TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code.CVE-2020-15702 · Other software · Canonical · reported by security@ubuntu.comHigh 7
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusn.ubuntu.comusn.ubuntu.com
Aug 6, 2020An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service.CVE-2020-15701 · Other software · Canonical · reported by security@ubuntu.comMedium 5.5
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.16, 2.20.11-0ubuntu27.6.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netusn.ubuntu.com
Apr 27, 2020Apport reads and writes information on a crashed process to /proc/pid with elevated privileges.CVE-2019-15790 · Other software · Canonical · reported by security@ubuntu.comLow 2.8
Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged user could exploit this to read information about a privileged running process by exploiting PID recycling. This information could then be used to obtain ASLR offsets for a process with an existing memory corruption vulnerability. The initial fix introduced regressions in the Python Apport library due to a missing argument in Report.add_proc_environ in apport/report.py. It also caused an autopkgtest failure when reading /proc/pid and with Python 2 compatibility by reading /proc maps. The initial and subsequent regression fixes are in 2.20.11-0ubuntu16, 2.20.11-0ubuntu8.6, 2.20.9-0ubuntu7.12, 2.20.1-0ubuntu2.22 and 2.14.1-0ubuntu3.29+esm3.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.combugs.launchpad.net
Apr 22, 2020Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity.CVE-2020-8833 · Other software · Canonical · reported by security@ubuntu.comMedium 5.6
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netusn.ubuntu.com
Apr 22, 2020Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory.CVE-2020-8831 · Other software · Canonical · reported by security@ubuntu.comMedium 6.5
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netusn.ubuntu.com
Apr 16, 2020Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames anCVE-2019-7306 · Other software · Canonical · reported by security@ubuntu.comMedium 4.3
Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu
- Product
- byobu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netcve.mitre.org
Feb 8, 2020Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.CVE-2019-11485 · Other software · Canonical · reported by security@ubuntu.comLow 3.3
Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusn.ubuntu.comusn.ubuntu.com
Feb 8, 2020Sander Bos discovered Apport mishandled crash dumps originating from containers.CVE-2019-11483 · Other software · Canonical · reported by security@ubuntu.comHigh 7
Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusn.ubuntu.comusn.ubuntu.com
Feb 8, 2020Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directCVE-2019-11482 · Other software · Canonical · reported by security@ubuntu.comMedium 4.2
Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusn.ubuntu.comusn.ubuntu.com
Feb 8, 2020Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges.CVE-2019-11481 · Other software · Canonical · reported by security@ubuntu.comLow 3.8
Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comusn.ubuntu.com
Aug 29, 2019Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability wCVE-2019-7307 · Other software · Ubuntu · reported by security@ubuntu.comHigh 7
Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system.
- Product
- apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.combugs.launchpad.net
Apr 22, 2019Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport beforeCVE-2015-1341 · Other software · Ubuntu · reported by security@ubuntu.comHigh 7.4
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netusn.ubuntu.com
May 31, 2018Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage tCVE-2018-6552 · Other software · Apport Project · reported by security@ubuntu.comHigh 7.8
Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers. The is_same_ns() function returns True when /proc/<global pid>/ does not exist in order to indicate that the crash should be handled in the global namespace rather than inside of a container. However, the portion of the data/apport code that decides whether or not to forward a crash to a container does not always replace sys.argv[1] with the value stored in the host_pid variable when /proc/<global pid>/ does not exist which results in the container pid being used in the global namespace. This flaw affects versions 2.20.8-0ubuntu4 through 2.20.9-0ubuntu7, 2.20.7-0ubuntu3.7, 2.20.7-0ubuntu3.8, 2.20.1-0ubuntu2.15 through 2.20.1-0ubuntu2.17, and 2.14.1-0ubuntu3.28.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordusn.ubuntu.comusn.ubuntu.com
Feb 2, 2018Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacCVE-2017-14180 · Other software · na/ · reported by security@ubuntu.comHigh 7.8
Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, a different vulnerability than CVE-2017-14179.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbazaar.launchpad.netlaunchpad.net
Feb 2, 2018Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker coulCVE-2017-14179 · Other software · Apport Project · reported by security@ubuntu.comHigh 7.8
Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.netpeople.canonical.com
Feb 2, 2018Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leveCVE-2017-14177 · Other software · Apport Project · reported by security@ubuntu.comHigh 7.8
Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1324.
- Product
- Apport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbazaar.launchpad.netlaunchpad.net
Aug 25, 2017Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 asCVE-2015-1325 · Other software · Canonical · reported by security@ubuntu.comHigh 7
Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges.
- Product
- Ubuntu Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Aug 25, 2017Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in UbuntCVE-2015-1324 · Other software · Canonical · reported by security@ubuntu.comHigh 7.8
Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges by leveraging incorrect handling of permissions when generating core dumps for setuid binaries.
- Product
- Ubuntu Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comubuntu.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.