PatchTheCVEapport project vulnerabilities
Recent CVEs affecting apport project products. 18 tracked.
apport project has 18 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2020-04-28. Highest priority: CVE-2016-9949 (score 62/100).
- CVE-2020-8833 MEDIUM 5.6 MITIGATE MITIGATE Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a
- CVE-2020-8831 MEDIUM 6.5 MITIGATE MITIGATE Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory
- CVE-2019-7307 HIGH 7.0 DOWNGRADE Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.
- CVE-2019-15790 LOW 2.8 MITIGATE MITIGATE Apport reads and writes information on a crashed process to /proc/pid with elevated privileges
- CVE-2019-11485 LOW 3.3 MITIGATE MITIGATE Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent
- CVE-2019-11483 HIGH 7.0 MITIGATE MITIGATE Sander Bos discovered Apport mishandled crash dumps originating from containers
- CVE-2019-11482 MEDIUM 4.2 MITIGATE MITIGATE Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to
- CVE-2019-11481 LOW 3.8 MITIGATE MITIGATE Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges
- CVE-2018-6552 HIGH 7.8 DOWNGRADE Apport does not properly handle crashes originating from a PID namespace allowing local users to create certai
- CVE-2017-14180 HIGH 7.8 UPGRADE MITIGATE Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local us
- CVE-2017-14179 HIGH 7.8 UPGRADE MITIGATE Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to c
- CVE-2017-14177 HIGH 7.8 UPGRADE MITIGATE Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create
- CVE-2017-10708 HIGH 7.8 UPGRADE An issue was discovered in Apport through 2.20.x
- CVE-2016-9951 MEDIUM 6.5 UPGRADE An issue was discovered in Apport before 2.20.4
- CVE-2016-9950 HIGH 7.8 UPGRADE UPGRADE An issue was discovered in Apport before 2.20.4
- CVE-2016-9949 HIGH 7.8 UPGRADE UPGRADE An issue was discovered in Apport before 2.20.4
- CVE-2015-1338 HIGH 7.2 UPGRADE MITIGATE kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or p
- CVE-2015-1318 HIGH 7.2 DOWNGRADE The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges
FAQ
How do I fix apport project vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is apport project being exploited right now?
None of the tracked apport project CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which apport project CVE should I patch first?
CVE-2016-9949 currently ranks highest (62/100): An issue was discovered in Apport before 2.20.4.