Apport Project

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high14CVSS 7.0–8.9

Exploited now

Apport Project records in CISA KEV

No Apport Project vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Apport 24 records MEDIUM

Records

24 records in Apport · all components

TI-2016-08055 CVE-2016-9949 · GHSA-5hh7-vqxx-v3cj

An issue was discovered in Apport before 2.20.4.

MEDIUM 51

An issue was discovered in Apport before 2.20.4.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.17726 Published 2016-12-17 No fix listed CWE-94

TI-2016-08056 CVE-2016-9950 · GHSA-rgrg-wm7f-3pp8

An issue was discovered in Apport before 2.20.4.

MEDIUM 43

An issue was discovered in Apport before 2.20.4.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.06549 Published 2016-12-17 No fix listed CWE-22

TI-2015-01197 CVE-2015-1318 · GHSA-cpww-w9jx-qp3p

The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local…

LOW 39

The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.04187 Published 2015-04-17 No fix listed CWE-264

TI-2017-07823 CVE-2017-10708 · GHSA-r8ph-m677-xqfj

An issue was discovered in Apport through 2.20.x.

LOW 38

An issue was discovered in Apport through 2.20.x.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.02099 Published 2017-07-18 No fix listed CWE-22

TI-2016-08057 CVE-2016-9951 · GHSA-666r-6mfg-455c

An issue was discovered in Apport before 2.20.4.

LOW 38

An issue was discovered in Apport before 2.20.4.

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.06674 Published 2016-12-17 No fix listed CWE-284

TI-2022-11302 CVE-2022-28657 · GHSA-m8cv-83cf-qccx

Apport does not disable python crash handler before entering chroot

LOW 35

Apport does not disable python crash handler before entering chroot

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00228 Published 2024-06-04 Fixed in 2.21.0 CWE-400

TI-2019-08573 CVE-2019-11481 · GHSA-7hrm-rprg-v656

Apport reads arbitrary files if ~/.config/apport/settings is a symlink

LOW 34

Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00453 Published 2020-02-08 Fixed in 2.14.1-0ubuntu3.29+esm2, 2.20.1-0ubuntu2.20 +2 CWE-59

TI-2018-04828 CVE-2018-6552 · GHSA-4pgc-f487-53cr

Apport treats the container PID as the global PID when /proc/<global_pid>/ is missing

LOW 34

Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possi…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00389 Published 2018-05-31 Fixed in 2.20.9-0ubuntu7.1, 2.20.1-0ubuntu2.18 +1

TI-2017-10332 CVE-2017-14180 · GHSA-q2pm-6838-p3jm

Uncontrolled resource consumption in na/ Apport

LOW 34

Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resour…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0044 Published 2018-02-02 No fix listed CWE-400

TI-2017-10331 CVE-2017-14179 · GHSA-6rjw-gqv7-rv3q

Uncontrolled resource consumption in Apport

LOW 34

Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhau…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00356 Published 2018-02-02 Fixed in 2.13 CWE-400

TI-2017-10329 CVE-2017-14177 · GHSA-gx65-cr2w-3vfm

Uncontrolled resource consumption in Apport

LOW 34

Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0039 Published 2018-02-02 No fix listed CWE-400

TI-2015-01217 CVE-2015-1338 · GHSA-77gx-3rjc-296q

kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service…

LOW 33

kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.0091 Published 2015-10-01 No fix listed CWE-59

TI-2022-11300 CVE-2022-28655 · GHSA-8jm9-f4h8-qchf

is_closing_session() allows users to create arbitrary tcp dbus connections

LOW 31

is_closing_session() allows users to create arbitrary tcp dbus connections

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00207 Published 2024-06-04 Fixed in 2.21.0 CWE-770

TI-2019-08575 CVE-2019-11483 · GHSA-43q8-jq5v-77gp

Sander Bos discovered Apport mishandled crash dumps originating from containers.

LOW 31

Sander Bos discovered Apport mishandled crash dumps originating from containers.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00401 Published 2020-02-08 Fixed in 2.14.1-0ubuntu3.29+esm2, 2.20.1-0ubuntu2.20 +2

TI-2019-05195 CVE-2019-7307 · GHSA-75vh-qgvc-r573

Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml

LOW 31

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allow…

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00326 Published 2019-08-29 Fixed in 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19 +3 CWE-367

TI-2022-11297 CVE-2022-28652 · GHSA-f474-ggqf-8jp5

~/.config/apport/settings parsing is vulnerable to "billion laughs" attack

LOW 30

~/.config/apport/settings parsing is vulnerable to "billion laughs" attack

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00199 Published 2024-06-04 Fixed in 2.21.0 CWE-776

TI-2020-07088 CVE-2020-8831 · GHSA-33w2-prhc-2q89

World writable root owned lock file created in user controllable location

LOW 30

Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00651 Published 2020-04-22 Fixed in 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14 +1 CWE-379

TI-2020-07090 CVE-2020-8833 · GHSA-w9g5-3qgc-xmgx

Apport race condition in crash report permissions

LOW 25

Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity.

CVSS 3.1MEDIUM 5.6 Local Low privileges No interaction EPSS 0.00344 Published 2020-04-22 Fixed in 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14 +1 CWE-367

TI-2022-11303 CVE-2022-28658 · GHSA-4pgv-p58j-ghpx

Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing

LOW 24

Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00204 Published 2024-06-04 Fixed in 2.21.0

TI-2022-11301 CVE-2022-28656 · GHSA-cx5x-4q8r-qxcm

is_closing_session() allows users to consume RAM in the Apport process

LOW 24

is_closing_session() allows users to consume RAM in the Apport process

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00199 Published 2024-06-04 Fixed in 2.21.0 CWE-770

TI-2022-11299 CVE-2022-28654 · GHSA-3v9h-v2jm-73mm

is_closing_session() allows users to fill up apport.log

LOW 24

is_closing_session() allows users to fill up apport.log

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00252 Published 2024-06-04 Fixed in 2.21.0 CWE-770

TI-2019-08574 CVE-2019-11482 · GHSA-fggm-83vw-5vwq

Race condition between reading current working directory and writing a core dump

LOW 21

Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.00232 Published 2020-02-08 Fixed in 2.14.1-0ubuntu3.29+esm2, 2.20.1-0ubuntu2.20 +2 CWE-367

TI-2019-11861 CVE-2019-15790 · GHSA-mv59-w8cf-g9q7

Apport reads PID files with elevated privileges

LOW 17

Apport reads and writes information on a crashed process to /proc/pid with elevated privileges.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00523 Published 2020-04-27 Fixed in 2.14.1-0ubuntu3.29+esm3, 2.20.1-0ubuntu2.22 +2 CWE-250

TI-2019-08577 CVE-2019-11485 · GHSA-3wqr-pcvr-hx5r

apport created lock file in wrong directory

LOW 16

Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.0026 Published 2020-02-08 Fixed in 2.14.1-0ubuntu3.29+esm2, 2.20.1-0ubuntu2.20 +2 CWE-412

Open these records in search →

Critical	0
High	14
Medium	8
Low	2
No CVSS	0