Canonical Apport vulnerabilities
34 vulnerabilities
Known vulnerabilities in Canonical Apport, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-25682canonicalapport+1
EPSS score0.45%
It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.CVE-2021-25683canonicalapport+1EPSS score0.43%
It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.CVE-2021-25684canonicalapport+1EPSS score0.57%
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.CVE-2021-32549canonicalapport+2EPSS score0.29%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.CVE-2021-32553canonicalapport+3EPSS score0.32%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.CVE-2021-32554canonicalapport+2EPSS score0.29%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.CVE-2021-32550canonicalapport+2EPSS score0.29%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.CVE-2021-32551canonicalapport+2EPSS score0.29%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.CVE-2021-32556canonicalapport+1EPSS score0.33%
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.CVE-2021-32547canonicalapport+2EPSS score0.30%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.CVE-2021-32555canonicalapport+2EPSS score0.29%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users.CVE-2021-32552canonicalapport+2EPSS score0.29%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.CVE-2021-32548canonicalapport+2EPSS score0.29%
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport hooks, it could expose private data to other local users.CVE-2021-32557canonicalapport+1EPSS score0.39%
It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.CVE-2021-3709canonicalapport+1EPSS score0.46%
Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;CVE-2021-3899canonical ltd.apport+3EPSS score0.38%
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root.CVE-2021-3710canonicalapport+1EPSS score0.46%
An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;CVE-2015-1341canonicalapport+3EPSS score0.43%
Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.CVE-2025-5054canonicalapport+2EPSS score0.76%
Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces.
When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing process resided in a container, was being called before `consistency_checks`, which attempts to detect if the crashing process had been replaced. Because of this, if a process crashed and was quickly replaced with a containerized one, apport could be made to forward the core dump to the container, potentially leaking sensitive information. `consistency_checks` is now being called before `_check_global_pid_and_forward`. Additionally, given that the PID-reuse race condition cannot be reliably detected from userspace alone, crashes are only forwarded to containers if the kernel provided a pidfd, or if the crashing process was unprivileged (i.e., if dump mode == 1).CVE-2025-5467canonicalapportEPSS score0.18%
It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.