USN-4449-1: Apport vulnerabilities
4 August 2020
Several security issues were fixed in Apport.
Releases
Packages
- apport - automatically generate crash reports for debugging
Details
Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that
Apport incorrectly dropped privileges when making certain D-Bus calls. A
local attacker could use this issue to read arbitrary files.
(CVE-2020-11936)
Seong-Joong Kim discovered that Apport incorrectly parsed configuration
files. A local attacker could use this issue to cause Apport to crash,
resulting in a denial of service. (CVE-2020-15701)
Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that
Apport incorrectly implemented certain checks. A local attacker could use
this issue to escalate privileges and run arbitrary code. (CVE-2020-15702)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
Ubuntu 18.04
Ubuntu 16.04
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-4449-2: python-apport, apport-valgrind, python-problem-report, dh-apport, python3-problem-report, apport-kde, python3-apport, apport-retrace, apport-noui, apport-gtk, apport