CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-28658
https://notcve.org/view.php?id=CVE-2022-28658
Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing El análisis de argumentos de Apport maneja mal la división de nombres de archivos en núcleos más antiguos, lo que resulta en suplantación de argumentos • https://ubuntu.com/security/notices/USN-5427-1 https://www.cve.org/CVERecord?id=CVE-2022-28658 •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2020-8831 – World writable root owned lock file created in user controllable location
https://notcve.org/view.php?id=CVE-2020-8831
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22. • https://launchpad.net/bugs/1862348 https://usn.ubuntu.com/4315-1 https://usn.ubuntu.com/4315-2 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-379: Creation of Temporary File in Directory with Insecure Permissions •
CVSS: 5.6EPSS: 0%CPEs: 5EXPL: 1CVE-2020-8833 – Apport race condition in crash report permissions
https://notcve.org/view.php?id=CVE-2020-8833
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22. Una vulnerabilidad de Condición de Carrera de tipo Time-of-check Time-of-use en el cambio de propiedad del reporte de bloqueo en Apport, permite una posible oportunidad de escalada de privilegios. • https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1862933 https://usn.ubuntu.com/4315-1 https://usn.ubuntu.com/4315-2 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 7.0EPSS: 0%CPEs: 6EXPL: 0CVE-2019-11483
https://notcve.org/view.php?id=CVE-2019-11483
Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. Sander Bos detectó que Apport manejó inapropiadamente los vertederos accidentales procedentes de contenedores. Esto podría ser utilizado por un atacante local para generar un reporte de bloqueo para un proceso privilegiado que pueda ser leído por un usuario no privilegiado. • https://usn.ubuntu.com/usn/usn-4171-1 https://usn.ubuntu.com/usn/usn-4171-2 •
CVSS: 3.3EPSS: 0%CPEs: 6EXPL: 0CVE-2019-11485 – apport created lock file in wrong directory
https://notcve.org/view.php?id=CVE-2019-11485
Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling. Sander Bos detectó que el archivo de bloqueo de Apport estaba en un directorio de tipo world-writable que permitía a todos los usuarios impedir el manejo de bloqueos. • https://usn.ubuntu.com/usn/usn-4171-1 https://usn.ubuntu.com/usn/usn-4171-2 • CWE-412: Unrestricted Externally Accessible Lock •