CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-25684 – apport can be stalled by reading a FIFO
https://notcve.org/view.php?id=CVE-2021-25684
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. Se descubrió que apport en data/apport no abría correctamente un archivo de informes para evitar lecturas colgadas en un FIFO • https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1912326 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 107EXPL: 1CVE-2020-15701 – Unhandled exception in apport
https://notcve.org/view.php?id=CVE-2020-15701
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed in 2.20.1-0ubuntu2.24, 2.20.9-0ubuntu7.16, 2.20.11-0ubuntu27.6. Un atacante local puede explotar una excepción no manejada en la función check_ignored() en el archivo apport/report.py para causar una denegación de servicio. Si el atributo mtime es un valor de cadena en apport-ignore.xml, desencadenará una excepción no manejada, resultando en un bloqueo. • https://launchpad.net/bugs/1877023 https://usn.ubuntu.com/4449-1 https://usn.ubuntu.com/4449-2 • CWE-755: Improper Handling of Exceptional Conditions •
CVSS: 7.0EPSS: 0%CPEs: 104EXPL: 0CVE-2020-15702 – TOCTOU in apport
https://notcve.org/view.php?id=CVE-2020-15702
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234. La vulnerabilidad de Condición de Carrera TOCTOU en apport permite a un atacante local escalar privilegios y ejecutar código arbitrario. • https://usn.ubuntu.com/4449-1 https://usn.ubuntu.com/4449-2 https://www.zerodayinitiative.com/advisories/ZDI-20-979 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •