Apport (Canonical) - vulnerabilities (CVEs)

27 CVEs, 0 in the last 30 days, 224 known versions, newest CVE from 2026-08-20. Vendor: Canonical.

CVEs of Apport

CVE-2026-77113 - CVSS 6.7 (medium), 2026-08-20: Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with…
CVE-2025-5467 - CVSS 3.3 (low), 2025-12-10: It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership,…
CVE-2025-5054 - CVSS 4.7 (medium), 2025-05-30: Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces.…
CVE-2020-11936 - CVSS 3.1 (low), 2025-01-31: gdbus setgid privilege escalation
CVE-2022-28653 - CVSS 7.5 (high), 2025-01-31: Users can consume unlimited disk space in /var/crash
CVE-2022-28657 - CVSS 7.8 (high), 2024-06-04: Apport does not disable python crash handler before entering chroot
CVE-2022-1242 - CVSS 7.8 (high), 2024-06-03: Apport can be tricked into connecting to arbitrary sockets as the root user
CVE-2021-3899 - CVSS 7.8 (high), 2024-06-03: There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as…
CVE-2023-1326 - CVSS 7.8 (high), 2023-04-13: A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow…
CVE-2021-3710 - CVSS 6.5 (medium), 2021-10-01: An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to…
CVE-2021-3709 - CVSS 6.5 (medium), 2021-10-01: Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This…
CVE-2021-32552 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package…
CVE-2021-32555 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package…
CVE-2021-32554 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport…
CVE-2021-32557 - CVSS 7.1 (high), 2021-06-12: It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.
CVE-2021-32553 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package…
CVE-2021-32556 - CVSS 3.8 (low), 2021-06-12: It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would…
CVE-2021-32549 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package…
CVE-2021-32548 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package…
CVE-2021-32551 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package…
CVE-2021-32550 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package…
CVE-2021-32547 - CVSS 7.3 (high), 2021-06-12: It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package…
CVE-2021-25683 - CVSS 8.8 (high), 2021-06-11: It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.
CVE-2021-25682 - CVSS 8.8 (high), 2021-06-11: It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.
CVE-2021-25684 - CVSS 8.8 (high), 2021-06-11: It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.
CVE-2020-15701 - CVSS 5.5 (medium), 2020-08-06: An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a…
CVE-2020-15702 - CVSS 7 (high), 2020-08-06: TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed…
CVE-2019-15790 - CVSS 3.3 (low), 2020-04-28: Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs…
CVE-2020-8831 - CVSS 6.5 (medium), 2020-04-22: Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this…
CVE-2020-8833 - CVSS 5.6 (medium), 2020-04-22: Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If…
CVE-2019-11482 - CVSS 4.7 (medium), 2020-02-08: Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary…
CVE-2019-11485 - CVSS 3.3 (low), 2020-02-08: Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.
CVE-2019-11483 - CVSS 7 (high), 2020-02-08: Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a…
CVE-2019-11481 - CVSS 7.8 (high), 2020-02-08: Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a…
CVE-2015-1341 - CVSS 7.8 (high), 2019-04-22: Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport…