CVE-2019-7307 Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users /.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on th...

CVE-2019-7307

CVE-2019-7307 affects Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5. The flaw is a TOCTTOU vulnerability when reading the user’s ~/.apport-ignore.xml, allowing a local attacker to replace that file with a symlink to an...

CVE-2019-11481

Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences...

PT-2019-4761 · Canonical · Apport +1

Name of the Vulnerable Software and Affected Versions: apport affected versions not specified Description: The issue is related to apport reading a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could potentially get apport to read an...

UBUNTU-CVE-2019-11481

Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences...

USN-4051-2 apport vulnerability

USN-4051-1 fixed a vulnerability in apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Kevin Backhouse discovered a race-condition when reading the user's local Apport configuration. This could be used by a local attacker to cause Apport to...

USN-4051-2: Apport vulnerability

USN-4051-1 fixed a vulnerability in apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Kevin Backhouse discovered a race-condition when reading the user's local Apport configuration. This could be used by a local attacker to cause Apport to...

USN-4051-1: Apport vulnerability

Kevin Backhouse discovered a race-condition when reading the user's local Apport configuration. This could be used by a local attacker to cause Apport to include arbitrary files in a resulting crash report...

USN-4051-1 apport vulnerability

Kevin Backhouse discovered a race-condition when reading the user's local Apport configuration. This could be used by a local attacker to cause Apport to include arbitrary files in a resulting crash report...

UBUNTU-CVE-2019-7307

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users /.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on th...

Ubuntu: Security Advisory (USN-4051-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-7307

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users /.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on th...

PT-2019-4928 · Canonical · Apport +1

Name of the Vulnerable Software and Affected Versions: Apport versions prior to 2.14.1-0ubuntu3.29+esm1 Apport versions prior to 2.20.1-0ubuntu2.19 Apport versions prior to 2.20.9-0ubuntu7.7 Apport versions prior to 2.20.10-0ubuntu27.1 Apport versions prior to 2.20.11-0ubuntu5 Description: The...

CVE-2015-1341

Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function pythonmodulepath...

Command injection

Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function pythonmodulepath...

CVE-2015-1341

Summary (CVE-2015-1341) : The Ubuntu/apport vulnerability allows a local attacker to escalate privileges by abusing Python module imports. Specifically, if the triggering process runs Python with the first argument -m and triggers a coredump, any Python module on sys.path could be imported by App...

CVE-2015-1341 Apport privilege escalation through Python module imports

Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function pythonmodulepath...

Ubuntu: Security Advisory (USN-3480-3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-3354-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu 14.04 LTS : Apport vulnerability (USN-3664-2)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3664-2 advisory. USN-3664-1 fixed a vulnerability in Apport. Sander Bos reported that Ubuntu 14.04 LTS was also vulnerable to this issue, but was incorrectly omitted from the...