Skip to content
OpenAdvisories
High USN-4965-2 11 CVEs

apport vulnerabilities

Published May 25, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

USN-4965-1 fixed several vulnerabilities in Apport. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:

Maik Münch discovered that Apport incorrectly handled certain information
gathering operations. A local attacker could use these issues to read and
write arbitrary files as an administrator, and possibly escalate
privileges.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS apport 2.14.1-0ubuntu3.29+esm7
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS apport 2.20.1-0ubuntu2.30+esm1

Vulnerabilities 11

  • High 7.3
    CVE-2021-32547

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32548

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32549

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32550

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32551

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32552

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32553

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32554

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • High 7.3
    CVE-2021-32555

    apport read_file() function could follow maliciously constructed symbolic links

    It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users.

    Canonical Apport apport Ubuntu
  • Medium 5.2
    CVE-2021-32557

    apport process_report() arbitrary file write

    It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.

    Canonical Apport apport Ubuntu
  • Low 3.8
    CVE-2021-32556

    apport get_modified_conffiles() function command injection

    It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.

    Canonical Apport apport Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2021-32547
  • report
    https://ubuntu.com/security/CVE-2021-32548
  • report
    https://ubuntu.com/security/CVE-2021-32549
  • report
    https://ubuntu.com/security/CVE-2021-32550
  • report
    https://ubuntu.com/security/CVE-2021-32551
  • report
    https://ubuntu.com/security/CVE-2021-32552
  • report
    https://ubuntu.com/security/CVE-2021-32553
  • report
    https://ubuntu.com/security/CVE-2021-32554
  • report
    https://ubuntu.com/security/CVE-2021-32555
  • report
    https://ubuntu.com/security/CVE-2021-32556
  • report
    https://ubuntu.com/security/CVE-2021-32557