CVE-2025-5467

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5467", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2025-06-02T12:03:56.269Z", "datePublished": "2025-12-10T18:00:35.967Z", "dateUpdated": "2025-12-10T18:45:08.960Z"}, "containers": {"cna": {"title": "Ubuntu Apport Insecure File Permissions Vulnerability", "datePublic": "2025-06-02T17:36:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-639", "descriptions": [{"lang": "en", "value": "CAPEC-639: Probe System Files"}]}], "affected": [{"vendor": "Canonical", "product": "apport", "collectionURL": "https://launchpad.net/ubuntu/+source/", "packageName": "apport", "programFiles": ["data/apport"], "programRoutines": [{"name": "process_crash()"}], "versions": [{"status": "affected", "version": "2.20.11-0ubuntu82", "lessThan": "2.20.11-0ubuntu82.7", "versionType": "dpkg"}, {"status": "affected", "version": "2.32.0", "lessThan": "2.32.0-0ubuntu5.1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.9", "lessThan": "2.20.9-0ubuntu7.29+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.28.1", "lessThan": "2.28.1-0ubuntu3.6", "versionType": "dpkg"}, {"status": "affected", "version": "2.33.0", "lessThan": "2.33.0-0ubuntu1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.1", "lessThan": "2.20.1-0ubuntu2.30+esm5", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.11-0ubuntu27", "lessThan": "2.20.11-0ubuntu27.28", "versionType": "dpkg"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups."}]}], "references": [{"url": "https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/"}, {"url": "https://bugs.launchpad.net/apport/+bug/2106338"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "baseSeverity": "LOW", "baseScore": 1.9, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}], "credits": [{"lang": "en", "value": "Rich Mirch", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2025-12-10T18:00:35.967Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-10T18:33:45.578963Z", "id": "CVE-2025-5467", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-10T18:45:08.960Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5467", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T18:33:45.578963Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-10T18:45:05.126Z"}}], "cna": {"title": "Ubuntu Apport Insecure File Permissions Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Rich Mirch"}], "impacts": [{"capecId": "CAPEC-639", "descriptions": [{"lang": "en", "value": "CAPEC-639: Probe System Files"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Canonical", "product": "apport", "versions": [{"status": "affected", "version": "2.20.11-0ubuntu82", "lessThan": "2.20.11-0ubuntu82.7", "versionType": "dpkg"}, {"status": "affected", "version": "2.32.0", "lessThan": "2.32.0-0ubuntu5.1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.9", "lessThan": "2.20.9-0ubuntu7.29+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.28.1", "lessThan": "2.28.1-0ubuntu3.6", "versionType": "dpkg"}, {"status": "affected", "version": "2.33.0", "lessThan": "2.33.0-0ubuntu1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.1", "lessThan": "2.20.1-0ubuntu2.30+esm5", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.11-0ubuntu27", "lessThan": "2.20.11-0ubuntu27.28", "versionType": "dpkg"}], "packageName": "apport", "programFiles": ["data/apport"], "collectionURL": "https://launchpad.net/ubuntu/+source/", "defaultStatus": "unaffected", "programRoutines": [{"name": "process_crash()"}]}], "datePublic": "2025-06-02T17:36:00.000Z", "references": [{"url": "https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/"}, {"url": "https://bugs.launchpad.net/apport/+bug/2106338"}], "descriptions": [{"lang": "en", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.", "supportingMedia": [{"type": "text/html", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2025-12-10T18:00:35.967Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5467", "state": "PUBLISHED", "dateUpdated": "2025-12-10T18:45:08.960Z", "dateReserved": "2025-06-02T12:03:56.269Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2025-12-10T18:00:35.967Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://launchpad.net/ubuntu/+source/", "defaultStatus": "unaffected", "packageName": "apport", "product": "apport", "programFiles": ["data/apport"], "programRoutines": [{"name": "process_crash()"}], "vendor": "Canonical", "versions": [{"lessThan": "2.20.11-0ubuntu82.7", "status": "affected", "version": "2.20.11-0ubuntu82", "versionType": "dpkg"}, {"lessThan": "2.32.0-0ubuntu5.1", "status": "affected", "version": "2.32.0", "versionType": "dpkg"}, {"lessThan": "2.20.9-0ubuntu7.29+esm1", "status": "affected", "version": "2.20.9", "versionType": "dpkg"}, {"lessThan": "2.28.1-0ubuntu3.6", "status": "affected", "version": "2.28.1", "versionType": "dpkg"}, {"lessThan": "2.33.0-0ubuntu1", "status": "affected", "version": "2.33.0", "versionType": "dpkg"}, {"lessThan": "2.20.1-0ubuntu2.30+esm5", "status": "affected", "version": "2.20.1", "versionType": "dpkg"}, {"lessThan": "2.20.11-0ubuntu27.28", "status": "affected", "version": "2.20.11-0ubuntu27", "versionType": "dpkg"}]}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FDEF7B7-318E-4C9B-AA8B-79157E87B4EF", "versionEndExcluding": "2.20.1-0ubuntu2.30", "versionStartIncluding": "2.20.1-0ubuntu1", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "matchCriteriaId": "3E142C34-69E2-4AC5-9770-9D8C978AD4DE", "versionEndExcluding": "2.20.9-0ubuntu7.29", "versionStartIncluding": "2.20.9-0ubuntu7", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "matchCriteriaId": "F9AAE270-D1C4-4A3D-8460-818589BC9C44", "versionEndExcluding": "2.20.11-0ubuntu27.28", "versionStartIncluding": "2.20.11-0ubuntu27", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "matchCriteriaId": "1FD1656C-892E-4C03-81BD-9AC9CDE8DA1B", "versionEndExcluding": "2.20.11-0ubuntu82.7", "versionStartIncluding": "2.20.11-0ubuntu82", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFA5AA56-DA6D-4656-A71D-ECA4CC330E80", "versionEndExcluding": "2.28.1-0ubuntu3.6", "versionStartIncluding": "2.28.1-0ubuntu1", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "matchCriteriaId": "EFAE79F8-E43C-42F8-81FB-49EECB97555C", "versionEndExcluding": "2.32.0-0ubuntu5.1", "versionStartIncluding": "2.32.0-0ubuntu1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups."}, {"lang": "es", "value": "Se descubri\u00f3 que process_crash() en data/apport, dentro de la herramienta de informes de fallos Apport de Canonical, puede crear archivos de fallo con una propiedad de grupo incorrecta, posiblemente exponiendo informaci\u00f3n de fallo m\u00e1s all\u00e1 de los grupos esperados o previstos."}], "id": "CVE-2025-5467", "lastModified": "2026-10-14T21:10:00.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5467", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-10T18:33:45.578963Z", "version": "2.0.3"}}]}, "published": "2025-12-10T18:16:19.070", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bugs.launchpad.net/apport/+bug/2106338"}, {"source": "security@ubuntu.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-708"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"created": "2025-12-11T15:17:45.439481+00:00", "updated": "2025-12-11T15:17:45.439507+00:00", "vendors": ["canonical", "canonical$PRODUCT$apport", "canonical$PRODUCT$ubuntu"]}