USN-4449-1: Apport vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• apport - automatically generate crash reports for debugging

Details

Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that
Apport incorrectly dropped privileges when making certain D-Bus calls. A
local attacker could use this issue to read arbitrary files.
(CVE-2020-11936)

Seong-Joong Kim discovered that Apport incorrectly parsed configuration
files. A local attacker could use this issue to cause Apport to crash,
resulting in a denial of service. (CVE-2020-15701)

Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that
Apport incorrectly implemented certain checks. A local attacker could use
this issue to escalate privileges and run arbitrary code. (CVE-2020-15702)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• apport - 2.20.11-0ubuntu27.6
• python3-apport - 2.20.11-0ubuntu27.6

Ubuntu 18.04

• apport - 2.20.9-0ubuntu7.16
• python-apport - 2.20.9-0ubuntu7.16
• python3-apport - 2.20.9-0ubuntu7.16

Ubuntu 16.04

• apport - 2.20.1-0ubuntu2.24
• python-apport - 2.20.1-0ubuntu2.24
• python3-apport - 2.20.1-0ubuntu2.24

In general, a standard system update will make all the necessary changes.

References

• CVE-2020-11936
• CVE-2020-15701
• CVE-2020-15702

Related notices

• USN-4449-2: apport, python3-apport, apport-valgrind, python-problem-report, apport-gtk, apport-kde, dh-apport, python-apport, apport-retrace, apport-noui, python3-problem-report