Apport can be tricked into connecting to arbitrary sockets as the root user

There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root

A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604

It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO

It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel

It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel

Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function…

Users can consume unlimited disk space in /var/crash

It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks

TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code

Path Traversal Vulnerability in apport-unpack

An information disclosure via path traversal was discovered in apport/hookutils.py function read_file()

Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file

An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service

Race condition in Canonical apport up to and including 2.32.0 allows a local attacker to leak sensitive information via PID-reuse by leveraging namespaces

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash…

It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1)…

gdbus setgid privilege escalation