CVSS: 9.3EPSS: 2%CPEs: 2EXPL: 3CVE-2016-9950 – Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution
https://notcve.org/view.php?id=CVE-2016-9950
15 Dec 2016 — An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system. Un problema fue descubierto en Apport en versiones anteriores a 2.20.4. • https://packetstorm.news/files/id/140207 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 10%CPEs: 1EXPL: 3CVE-2016-9951 – Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution
https://notcve.org/view.php?id=CVE-2016-9951
15 Dec 2016 — An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the Relaunch button on Apport crash files generated by local systems. The Relaunch button will be hidden when crash files are opened directly in Apport-GTK. • https://packetstorm.news/files/id/140207 • CWE-284: Improper Access Control •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 4CVE-2015-1338 – Apport 2.19 (Ubuntu 15.04) - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-1338
24 Sep 2015 — kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log. kernel_crashdump en Apport en versiones anteriores a 2.19, permite a usuarios locales provocar una denegación de servicio (consumo de disco) o posiblemente obtener privilegios a través de un ataque de enlace (1) simbólico o (2) duro en /var/crash/vmcore.log. Halfdog discovered that Apport incorrectly handled ... • https://packetstorm.news/files/id/133723 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 28%CPEs: 18EXPL: 7CVE-2015-1318 – Apport 2.14.1 (Ubuntu 14.04.2) - Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2015-1318
14 Apr 2015 — The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container). La característica de informes de caídas en Apport 2.13 hasta 2.17.x anterior a 2.17.1 permite a usuarios locales ganar privilegios a través de un fichero usr/share/apport/apport manipulado en un espacio de nombre (contenedor). Apport incorrectly handled the crash reporting feature. A local attacker could use this issue to gain el... • https://packetstorm.news/files/id/146235 • CWE-264: Permissions, Privileges, and Access Controls •