Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml
Priority LOW 31CWE-367Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system.
Why it matters now
EPSS 0.00326 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed apport (Ubuntu): 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7 +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Ubuntu | apport | before 2.14.1-0ubuntu3.29+esm1; before 2.20.1-0ubuntu2.19; before 2.20.9-0ubuntu7.7; before 2.20.10-0ubuntu27.1; before 2.20.11-0ubuntu5 | 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 | Patch available | CNA |
- apport VendorUbuntu Affected before 2.14.1-0ubuntu3.29+esm1; before 2.20.1-0ubuntu2.19; before 2.20.9-0ubuntu7.7; before 2.20.10-0ubuntu27.1; before 2.20.11-0ubuntu5 Fixed in 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apport_project:apport:2.14.1:*:*:*:*:*:*:* | 2.14.1 | Vulnerable | Apport Project |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Running on | Canonical |
| cpe:2.3:a:apport_project:apport:2.20.1:*:*:*:*:*:*:* | 2.20.1 | Vulnerable | Apport Project |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Running on | Canonical |
| cpe:2.3:a:apport_project:apport:2.20.9:*:*:*:*:*:*:* | 2.20.9 | Vulnerable | Apport Project |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Running on | Canonical |
| cpe:2.3:a:apport_project:apport:2.20.10:*:*:*:*:*:*:* | 2.20.10 | Vulnerable | Apport Project |
| cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* | 19.10 | Running on | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Running on | Canonical |
- cpe:2.3:a:apport_project:apport:2.14.1:*:*:*:*:*:*:* Versions 2.14.1 Vulnerable ·Apport Project
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Running on ·Canonical
- cpe:2.3:a:apport_project:apport:2.20.1:*:*:*:*:*:*:* Versions 2.20.1 Vulnerable ·Apport Project
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Running on ·Canonical
- cpe:2.3:a:apport_project:apport:2.20.9:*:*:*:*:*:*:* Versions 2.20.9 Vulnerable ·Apport Project
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Running on ·Canonical
- cpe:2.3:a:apport_project:apport:2.20.10:*:*:*:*:*:*:* Versions 2.20.10 Vulnerable ·Apport Project
- cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* Versions 19.10 Running on ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Running on ·Canonical
Remediation
- Fix · CNA apport (Ubuntu) Fixed in 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5
Timeline
- 2026-10-02 Threatist record created from CVE-2019-7307
- 2026-10-03 Alias added: GHSA-75vh-qgvc-r573
References
More Ubuntu vulnerabilities
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
- TI-2004-01032 Multiple vulnerabilities in the IGMP functionality for Linux kernel 2.4.22 to 2.4.28, and… CVSS 2.0HIGH 10.0
- TI-2004-00896 Multiple buffer overflows in libXML 2.6.12 and 2.6.13 (libxml2), and possibly other… CVSS 2.0HIGH 10.0
- TI-2004-00800 Buffer overflow in the QFILEPATHINFO request handler in Samba 3.0.x through 3.0.7 may… CVSS 2.0HIGH 10.0
- TI-2004-00962 Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to… CVSS 2.0HIGH 10.0
Sources
- CVE-2019-7307 · CVE Program
- CVE-2019-7307 · NVD
- FIRST EPSS
- GHSA-75vh-qgvc-r573 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences