| CVE-2022-28658 | TRUNG BÌNH5.5 | Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing | 04/06/2024 |
| CVE-2022-28657 | CAO7.8 | Apport does not disable python crash handler before entering chroot | 04/06/2024 |
| CVE-2022-28656 | TRUNG BÌNH5.5 | is_closing_session() allows users to consume RAM in the Apport process | 04/06/2024 |
| CVE-2022-28655 | CAO7.1 | is_closing_session() allows users to create arbitrary tcp dbus connections | 04/06/2024 |
| CVE-2022-28654 | TRUNG BÌNH5.5 | is_closing_session() allows users to fill up apport.log | 04/06/2024 |
| CVE-2022-28652 | TRUNG BÌNH5.5 | ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack | 04/06/2024 |
| CVE-2019-7307 | CAO7.0 | Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause | 29/08/2019 |
| CVE-2018-6552 | CAO7.8 | Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers. The is_same_ns() function returns True when /pr | 31/05/2018 |
| CVE-2017-14180 | CAO7.8 | Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, a different vulnerability than CVE-2017-14179. | 02/02/2018 |
| CVE-2017-14179 | CAO7.8 | Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers. | 02/02/2018 |
| CVE-2017-14177 | CAO7.8 | Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges. NOTE: this vulnerability exists because of an incomplete fix for | 02/02/2018 |
| CVE-2017-10708 | CAO7.8 | An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific hooks without protecting against path traversal. This allows remote attackers to execute arbitrary code via a crafted .crash file. | 18/07/2017 |
| CVE-2016-9951 | TRUNG BÌNH6.5 | An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the Relaunch button on | 17/12/2016 |
| CVE-2016-9950 | CAO7.8 | An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execu | 17/12/2016 |
| CVE-2016-9949 | CAO7.8 | An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code. | 17/12/2016 |
| CVE-2015-1338 | CAO7.2 | kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log. | 01/10/2015 |
| CVE-2015-1318 | CAO7.2 | The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container). | 17/04/2015 |