CVE-2016-9951: apport_project apport Improper Access Control

EPSS trend

Probability

6.67%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 6.67% on 18-09-2026

18-09-202618-10-2026

EPSS score

6.67%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (donncha.is)
Maturity: unknown
exploit-databaselocallinuxUnverified
Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution
Maturity: poc

References

9 links

github.com/DonnchaC/ubuntu-apport-exploitationX Refsource MISCIssue TrackingThird Party Advisory
donncha.is/2016/12/compromising-ubuntu-desktop/X Refsource MISCExploitTechnical DescriptionThird Party AdvisoryREPORT
bugs.launchpad.net/apport/+bug/1648806X Refsource MISCIssue TrackingPatch
www.securityfocus.com/bid/95011VDB EntryX Refsource BIDThird Party Advisory
www.ubuntu.com/usn/USN-3157-1Vendor AdvisoryX Refsource UBUNTU
www.exploit-db.com/exploits/40937/ExploitX Refsource EXPLOIT DB
ubuntu.com/security/CVE-2016-9951REPORT
ubuntu.com/security/notices/USN-3157-1Advisory
www.cve.org/CVERecord?id=CVE-2016-9951REPORT

Related vulnerabilities

CVE-2018-6552apport_projectapport+10.39%8y ago31-05-2018 22:00Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers. The is_same_ns() function returns True when /proc/<global pid>/ does not exist in order to indicate that the crash should be handled in the global namespace rather than inside of a container. However, the portion of the data/apport code that decides whether or not to forward a crash to a container does not always replace sys.argv[1] with the value stored in the host_pid variable when /proc/<global pid>/ does not exist which results in the container pid being used in the global namespace. This flaw affects versions 2.20.8-0ubuntu4 through 2.20.9-0ubuntu7, 2.20.7-0ubuntu3.7, 2.20.7-0ubuntu3.8, 2.20.1-0ubuntu2.15 through 2.20.1-0ubuntu2.17, and 2.14.1-0ubuntu3.28.CVE-2015-1338apport_projectapport+60.91%11y ago01-10-2015 20:00kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.CVE-2015-1318apport_projectapport+14.19%11y ago17-04-2015 17:00The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container).CVE-2016-9949apport_projectapport+217.73%9y ago17-12-2016 03:34An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code.CVE-2016-9950apport_projectapport+26.55%9y ago17-12-2016 03:34An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.CVE-2020-8833apport_projectapport+30.34%6y ago22-04-2020 21:15Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.

All vulnerabilities inapport

CVE-2016-9951: apport_project apport Improper Access Control

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References