CVE-2021-3709

Apport file permission bypass through emacs byte compilation errors

Published Oct 1, 2021 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2021-26992 Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;
Ubuntu USN Ubuntu USN USN-5077-1 Apport vulnerabilities
Ubuntu USN Ubuntu USN USN-5077-2 Apport vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
canonical
Published
Updated
Sep 16, 2024, 11:31 PM
Reserved
Aug 16, 2021, 12:00 AM
Status
Modified
Published
Oct 1, 2021, 3:15 AM
Modified
Jun 17, 2026, 4:05 AM