Apport is Ubuntu's automatic crash-reporting and debugging tool, a system component widely integrated into Debian-based distributions to capture and transmit diagnostic data following application failures. Despite its narrow product scope, the tool occupies a privileged position in the boot and crash-handling path, making its security posture relevant across a broad installed base. The vulnerability profile recurs through resource-exhaustion and file-access weaknesses—including uncontrolled resource consumption, improper link resolution, and time-of-check time-of-use race conditions—that reflect the challenges of safe temporary-file handling and subprocess isolation in a system service running with elevated privileges. These weakness classes have a documented tendency to acquire public exploit code, reflecting the accessibility of the attack surface to local users on affected systems. Defenders should monitor this vendor's advisories closely given the tool's depth of integration; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Apport Project over time
Signals from CVEs in this vendor scope (30 CVEs).
30 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-9949HIGH An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows | Dec 17, 2016 | 7.8 | 45 | NO | YES |
CVE-2015-1318HIGH The crash reporting feature in Apport 2.13 through 2.17.x before 2.17.1 allows local users to gain privileges via a crafted usr/share/apport/apport file in a namespace (container). | Apr 17, 2015 | 7.2 | 36 | NO | YES |
CVE-2016-9950HIGH An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a pat | Dec 17, 2016 | 7.8 | 31 | NO | YES |
CVE-2016-9951MEDIUM An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be execu | Dec 17, 2016 | 6.5 | 28 | NO | YES |
CVE-2015-1338HIGH kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on / | Oct 1, 2015 | 7.2 | 27 | NO | YES |
CVE-2023-1326HIGH A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run | Apr 13, 2023 | 7.8 | 26 | NO | NO |
CVE-2018-6552HIGH Apport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial o | May 31, 2018 | 7.8 | 25 | NO | NO |
CVE-2017-10708HIGH An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific hooks without protecti | Jul 18, 2017 | 7.8 | 25 | NO | NO |
CVE-2022-1242HIGH Apport can be tricked into connecting to arbitrary sockets as the root user | Jun 3, 2024 | 7.8 | 24 | NO | NO |
CVE-2021-3899HIGH There is a race condition in the 'replaced executable' detection that, with the correct local configuration, allow an attacker to execute arbitrary code as root. | Jun 3, 2024 | 7.8 | 24 | NO | NO |
Signals from CVEs in this vendor scope (30 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Apport Project.
Media articles that mention a CVE ID that affects a product developed by Apport Project — matched by CVE ID, not by vendor name.