Description
An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | apport | 2.20.1-0ubuntu2.4 | USN-3157-1 |
| Ubuntu 14.04 LTS | apport | 2.14.1-0ubuntu3.23 | USN-3157-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution EDB-40937 · local · Dec 14, 2016
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- USN-3157-1 apport vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026