CVE-2016-9949 is a critical vulnerability affecting Apport versions prior to 2.20.4, including various Ubuntu Linux distributions. This flaw allows remote attackers to execute arbitrary Python code by manipulating the CrashDB field, which Apport incorrectly evaluates as code if it starts with a curly brace. With a CVSS score of 7.8 (High), successful exploitation could lead to complete compromise of confidentiality, integrity, and availability on the affected system. While not actively exploited in the wild (KEV), public exploit code exists (EDB-40937), indicating a tangible threat, despite minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.20.3CPE matchmatch criteria | cpe:2.3:a:apport_project:apport:*:*:*:*:*:*:*:* | ||
<= 12.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.