← back
CVE-2016-9949

CVE-2016-9949

EPSS 17.7%
An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/40937/unverifiedexploitdbwww.exploit-db.com/exploits/40937unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://bugs.launchpad.net/apport/+bug/1648806https://donncha.is/2016/12/compromising-ubuntu-desktop/https://github.com/DonnchaC/ubuntu-apport-exploitationhttps://www.exploit-db.com/exploits/40937/http://www.securityfocus.com/bid/95011http://www.ubuntu.com/usn/USN-3157-1