CVE-2021-3709: falha de média gravidade em Canonical apport
Apport file permission bypass through emacs byte compilation errors
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.5%
probabilidade de exploração
0.5%top 62% das CVEs
exploração observada
nãonenhuma fonte reporta
Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
Canonical · apportCVEs relacionadas — Canonical apport
No mesmo produto, das mais perigosas para as menos.
CVE-2021-25684HIGHapport can be stalled by reading a FIFOEPSS 0.6%CVE-2020-15702HIGHTOCTOU in apportEPSS 0.5%CVE-2021-3710MEDIUMApport info disclosure via path traversal bug in read_fileEPSS 0.5%CVE-2021-25682HIGHapport improperly parses /proc/pid/statusEPSS 0.5%CVE-2019-11481LOWApport reads arbitrary files if ~/.config/apport/settings is a symlinkEPSS 0.5%CVE-2021-25683HIGHapport improperly parses /proc/pid/statEPSS 0.4%