Ubuntu: Security Advisory (USN-4965-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-4171-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Arbitrary Code Execution

apport is vulnerable to race condition. The vulnerability exists in the 'replaced executable' detection that with the correct local configuration which allows an attacker to execute arbitrary code as root...

Privilege Escalation

Apport is vulnerable to privilege escalation. The vulnerability exists because of incorrect handling of connections to Apport sockets inside containers which allows a local attacker to use this issue to connect to arbitrary sockets as the root user...

Spoofing Attacks

apport is vulnerable to spoofing attacks. The vulnerability exists due to the mishandled filename splitting on older kernels when parsing the Apport argument...

Arbitrary Code Execution

apport is vulnerable to arbitrary code execution. The vulnerability exists beause it does not disable python crash handler before entering chroot which allows an attacker to inject arbitrary codes...

Denial Of Service (DoS)

apport is vulnerable to denial of service. The vulnerability exists due to an lack of validation of the isclosingsession allowing an attacker to crash the system...

Denial Of Service (DoS)

apport is vulnerable to denial of service. An attacker can crash the application through the billion laughs attack by providing a malicious input to the /.config/apport/settings...

Ubuntu: Security Advisory (USN-5427-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2022-28657

Apport does not disable python crash handler before entering chroot...

UBUNTU-CVE-2022-28654

isclosingsession allows users to fill up apport.log...

CVE-2022-28658

Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing...

CVE-2022-28657

Apport does not disable python crash handler before entering chroot...

CVE-2022-28656

isclosingsession allows users to consume RAM in the Apport process...

CVE-2022-1242

Apport can be tricked into connecting to arbitrary sockets as the root user...

UBUNTU-CVE-2022-28656

isclosingsession allows users to consume RAM in the Apport process...

UBUNTU-CVE-2022-1242

Apport can be tricked into connecting to arbitrary sockets as the root user...

UBUNTU-CVE-2022-28652

/.config/apport/settings parsing is vulnerable to "billion laughs" attack...

UBUNTU-CVE-2022-28658

Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing...

USN-5427-1 apport vulnerabilities

Muqing Liu and neoni discovered that Apport incorrectly handled detecting if an executable was replaced after a crash. A local attacker could possibly use this issue to execute arbitrary code as the root user. CVE-2021-3899 Gerrit Venema discovered that Apport incorrectly handled connections to...