USN-4449-2: Apport vulnerabilities
2 September 2020
Several security issues were fixed in Apport.
Releases
Packages
- apport - automatically generate crash reports for debugging
Details
USN-4449-1 fixed several vulnerabilities in Apport. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that
Apport incorrectly dropped privileges when making certain D-Bus calls. A
local attacker could use this issue to read arbitrary files.
(CVE-2020-11936)
Seong-Joong Kim discovered that Apport incorrectly parsed configuration
files. A local attacker could use this issue to cause Apport to crash,
resulting in a denial of service. (CVE-2020-15701)
Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that
Apport incorrectly implemented certain checks. A local attacker could use
this issue to escalate privileges and run arbitrary code. (CVE-2020-15702)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.04
-
python-apport
-
2.14.1-0ubuntu3.29+esm5
-
python3-apport
-
2.14.1-0ubuntu3.29+esm5
-
apport
-
2.14.1-0ubuntu3.29+esm5
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-4449-1: apport, python3-apport, apport-valgrind, python-problem-report, apport-gtk, apport-kde, dh-apport, python-apport, apport-retrace, apport-noui, python3-problem-report