Canonical

Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces.

gdbus setgid privilege escalation

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended grou…

Users can consume unlimited disk space in /var/crash

It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.

A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604.

It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.

It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.

There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.

Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.

Apport can be tricked into connecting to arbitrary sockets as the root user

It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.

TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code.

An information disclosure via path traversal was discovered in apport/hookutils.py function read_file().

Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file.

An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service.

It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.