CVE-2019-11483

CVE-2019-11483 affects the Ubuntu Apport package. The issue arises from mishandling crash dumps originating from containers, potentially allowing a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. Connected advisories (USN-4171-5/6) indi...

CVE-2019-11485

CVE-2019-11485 affects the Ubuntu Apport package: the lock file is created in a world-writable directory, allowing a local authenticated user to prevent crash handling. This is a local-priority issue with low to moderate impact as described, and remediation is via the corresponding Ubuntu securit...

CVE-2019-11481

CVE-2019-11481 affects Ubuntu Apport: a local attacker could cause Apport to read a configuration file with root privileges by replacing the file with a symbolic link, allowing read access to arbitrary files as root. Root cause is the handling of user-supplied settings during crash-dump/report ge...

CVE-2019-11482

CVE-2019-11482 affects Ubuntu Apport: a TOCTTOU flaw during core-dump handling could allow a local user to have core files written in arbitrary directories. Documented impact is local, with no exploitation probability given. Concretely, Apport mishandles crash dumps, enabling core file writes to ...

CVE-2019-15790

CVE-2019-15790 concerns Ubuntu’s Apport crash-dump handling. The records show an unprivileged user could read information about a privileged process from /proc/pid and use it to obtain ASLR offsets for a memory-corruption vulnerability, via PID recycling. The root cause involves Apport reading/wr...

CVE-2020-8831

CVE-2020-8831 : Apport creates a world-writable lock file with root ownership in /var/lock/apport. If the directory is missing (common on tmpfs), Apport creates it; otherwise it uses the existing directory. This enables a symlink attack by placing a link at /var/lock/apport to redirect Apport’s l...

CVE-2020-8833

The CVE-2020-8833 issue affects Ubuntu’s Apport crash-report handling. A Time-of-check Time-of-use race between os.open and os.chown can allow a local attacker to change crash-file ownership to root when fs.protected_symlinks is disabled, via a symlink with the same name as a deleted file. The fi...