Apport at a glance
- Last 12 months
- 4
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 4
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 2 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 1 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 1 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 1 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 2 | 0 |
| Dec 2024 | 0 | 0 |
41 results · Feed
-
High 7.3
apport: Local privilege escalation to root via ldd execution on an attacker-controlled ExecutablePath in automatic crash report processing
In apport before 2.37.0, an improper privilege management vulnerability allows an unprivileged local attacker to gain root privileges on systems where automatic crash reporting is enabled. The automatic crash report processing pipeline runs as root and execut…
-
Medium 5.7
apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys
In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-…
-
Medium 6.7CVE-2026-77113 Public exploit
Path Traversal Vulnerability in apport-unpack
Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.
-
Low 1.9
Ubuntu Apport Insecure File Permissions Vulnerability
It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.
-
Medium 4.7CVE-2025-5054 Public exploit
Race Condition in Canonical Apport
Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces. When handling a crash, the function `_check_global_pid_and_forward`, which detects if the crashing proc…
-
Low 3.1
-
High 7.5
-
Medium 5.5
Apport argument parsing mishandles filename splitting on older kernels resulting in argument spoofing
-
High 7.8
Apport does not disable python crash handler before entering chroot
-
Medium 5.5
is_closing_session() allows users to consume RAM in the Apport process
-
High 7.1
is_closing_session() allows users to create arbitrary tcp dbus connections
-
Medium 5.5
is_closing_session() allows users to fill up apport.log
-
Medium 5.5
~/.config/apport/settings parsing is vulnerable to "billion laughs" attack
-
High 7.8
Apport can be tricked into connecting to arbitrary sockets as the root user
-
High 7.8CVE-2021-3899 Public exploit
There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an a…
-
High 7.7CVE-2023-1326 Public exploit
local privilege escalation in apport-cli
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be …
-
Medium 6.5
Apport info disclosure via path traversal bug in read_file
An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.…
-
Medium 6.5
Apport file permission bypass through emacs byte compilation errors
Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-…
-
Medium 5.2
apport process_report() arbitrary file write
It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.
-
Low 3.8
apport get_modified_conffiles() function command injection
It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport hooks, it could expose private data to other local users.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.
-
High 7.3
apport read_file() function could follow maliciously constructed symbolic links
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.
-
High 8.8
apport can be stalled by reading a FIFO
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO.
-
High 8.8
apport improperly parses /proc/pid/stat
It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel.
-
High 8.8
apport improperly parses /proc/pid/status
It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel.
-
High 7.0
TOCTOU in apport
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which…
-
Medium 5.5
Unhandled exception in apport
An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtime attribute is a string value in apport-ignore.xml, it will trigger an unhandled exception, resulting in a crash. Fixed…
-
Low 2.8
Apport reads PID files with elevated privileges
Apport reads and writes information on a crashed process to /proc/pid with elevated privileges. Apport then determines which user the crashed process belongs to by reading /proc/pid through get_pid_info() in data/apport. An unprivileged user could exploit thi…
-
Medium 6.5
World writable root owned lock file created in user controllable location
Apport creates a world writable lock file with root ownership in the world writable /var/lock/apport directory. If the apport/ directory does not exist (this is not uncommon as /var/lock is a tmpfs), it will create the directory, otherwise it will simply cont…
-
Medium 5.6
Apport race condition in crash report permissions
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when t…
-
Low 3.3
apport created lock file in wrong directory
Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.
-
High 7.0
Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker…
-
Medium 4.2
Race condition between reading current working directory and writing a core dump
Sander Bos discovered a time of check to time of use (TOCTTOU) vulnerability in apport that allowed a user to cause core files to be written in arbitrary directories.