Design/Logic Flaw

Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist this is not uncommon as /var/lock is a tmpfs, it will create the directory, otherwise it will simply continue execution using the existing...

Race condition

Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protectedsymlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash...

CVE-2020-8833 Apport race condition in crash report permissions

Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protectedsymlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash...

CVE-2020-8831

CVE-2020-8831 : Apport creates a world-writable lock file with root ownership in /var/lock/apport. If the directory is missing (common on tmpfs), Apport creates it; otherwise it uses the existing directory. This enables a symlink attack by placing a link at /var/lock/apport to redirect Apport’s l...

CVE-2020-8833

The CVE-2020-8833 issue affects Ubuntu’s Apport crash-report handling. A Time-of-check Time-of-use race between os.open and os.chown can allow a local attacker to change crash-file ownership to root when fs.protected_symlinks is disabled, via a symlink with the same name as a deleted file. The fi...

CVE-2020-8831 World writable root owned lock file created in user controllable location

Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist this is not uncommon as /var/lock is a tmpfs, it will create the directory, otherwise it will simply continue execution using the existing...

CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

DEBIAN-CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

Design/Logic Flaw

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

UBUNTU-CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

CVE-2019-7306

CVE-2019-7306 concerns Byobu, where the Apport hook may disclose sensitive information by auto-uploading the local user’s .screenrc (potentially exposing hostnames, usernames, and passwords). The connected OSV/Ubuntu entries confirm Byobu as the affected component and describe the disclosure risk...

CVE-2019-7306 Byobu apport hook uploads user's ~/.screenrc

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

CVE-2019-7306

Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc which may contain private hostnames, usernames and passwords. This issue affects: byobu...

The vulnerability of the ~/.apport-ignore.xml file, which is part of the apport error reporting service, allows a hacker to read arbitrary files.

The vulnerability of the /.apport-ignore.xml file of the apport error reporting service arises due to synchronization errors when using a shared resource. Exploiting this vulnerability allows an attacker to read arbitrary files...

Apport Arbitrary File Read Vulnerability

Apport is a toolkit for collecting and giving feedback on error messages information that the operating system finds useful when an application crashes. A security vulnerability exists in Apport. A local attacker can exploit this vulnerability by performing a symbolic link attack to read arbitrar...

The vulnerability of the apport operating system’s error registration service allows a hacker to trigger a service failure.

The vulnerability of the apport operating system’s error registration service relates to the blocking with unlimited external access. Exploiting this vulnerability could allow a perpetrator to cause a service failure...

The vulnerability of the /proc/$PID/ component of the Ubuntu operating system’s apport error logging service allows a malicious actor to create a publicly accessible report of a software bug for a privileged process.

The vulnerability of the /proc/$PID/ component of the Ubuntu operating system’s apport error logging service is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to create a publicly accessible report of the software bug for the privileged process...

The vulnerability of the apport operating system’s error registration service, related to deficiencies in access control, allows a malicious actor to create a publicly accessible report of the software bug for privileged processes.

The vulnerability of the apport system’s error reporting service in the Ubuntu operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to create a publicly accessible report of the software bug for privileged processes...