Skip to content
CVE PROGRAM SOURCE RECORD3.8 Low

CVE-2019-11481

Apport reads arbitrary files if ~/.config/apport/settings is a symlink

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
canonical

Description

Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Canonical apport

  • 2.14.1 to < 2.14.1-0ubuntu3.29+esm2affected
  • 2.20.1 to < 2.20.1-0ubuntu2.20affected
  • 2.20.9 to < 2.20.9-0ubuntu7.8affected
  • 2.20.11 to < 2.20.11-0ubuntu8.1affected

References