Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1324.
| Software | From | Fixed in |
|---|---|---|
| apport_project / apport | - | 2.20.7.x |
| canonical / ubuntu_linux | 16.04 | 16.04.x |
| canonical / ubuntu_linux | 14.04 | 14.04.x |
| canonical / ubuntu_linux | 17.04 | 17.04.x |
| canonical / ubuntu_linux | 17.10 | 17.10.x |
| canonical / ubuntu_linux | 18.04 | 18.04.x |