CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-25684 – apport can be stalled by reading a FIFO
https://notcve.org/view.php?id=CVE-2021-25684
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. Se descubrió que apport en data/apport no abría correctamente un archivo de informes para evitar lecturas colgadas en un FIFO • https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 107EXPL: 1CVE-2020-15701 – Unhandled exception in apport
https://notcve.org/view.php?id=CVE-2020-15701
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.16, 2.20.11-0ubuntu27.6. Un atacante local puede explotar una excepción no manejada en la función check_ignored() en el archivo apport/report.py para causar una denegación de servicio. Si el atributo mtime es un valor de cadena en apport-ignore.xml, desencadenará una excepción no manejada, resultando en un bloqueo. • https://launchpad.net/bugs/1877023 https://usn.ubuntu.com/4449-1 https://usn.ubuntu.com/4449-2 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.0EPSS: 0%CPEs: 104EXPL: 0CVE-2020-15702 – TOCTOU in apport
https://notcve.org/view.php?id=CVE-2020-15702
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234. La vulnerabilidad de Condición de Carrera TOCTOU en apport permite a un atacante local escalar privilegios y ejecutar código arbitrario. • https://usn.ubuntu.com/4449-1 https://usn.ubuntu.com/4449-2 https://www.zerodayinitiative.com/advisories/ZDI-20-979 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 5.6EPSS: 0%CPEs: 5EXPL: 1CVE-2020-8833 – Apport race condition in crash report permissions
https://notcve.org/view.php?id=CVE-2020-8833
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called, changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22. Una vulnerabilidad de Condición de Carrera de tipo Time-of-check Time-of-use en el cambio de propiedad del reporte de bloqueo en Apport, permite una posible oportunidad de escalada de privilegios. • https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1862933 https://usn.ubuntu.com/4315-1 https://usn.ubuntu.com/4315-2 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 1CVE-2020-8831 – World writable root owned lock file created in user controllable location
https://notcve.org/view.php?id=CVE-2020-8831
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply continue execution using the existing directory. This allows for a symlink attack if an attacker were to create a symlink at /var/lock/apport, changing apport's lock file location. This file could then be used to escalate privileges, for example. Fixed in versions 2.20.1-0ubuntu2.23, 2.20.9-0ubuntu7.14, 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22. • https://launchpad.net/bugs/1862348 https://usn.ubuntu.com/4315-1 https://usn.ubuntu.com/4315-2 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-379: Creation of Temporary File in Directory with Insecure Permissions •