Permissions, Privileges, and Access Controls in apport (Ubuntu package) - CVE-2019-15790

Vulnerability identifier: #VU22533

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-15790

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to Apport reads various process-specific files with elevated privileges during crash dump generation. A local user can force the application to generate a crash report for a privileged process and gain access to sensitive information.

apport (Ubuntu package)
python3-apport (Ubuntu package)
python-apport (Ubuntu package)
Ubuntu

Update the affected packages.

Ubuntu 19.10

apport - 2.20.11-0ubuntu8.2

python-apport - 2.20.11-0ubuntu8.2

python3-apport - 2.20.11-0ubuntu8.2

Ubuntu 19.04

apport - 2.20.10-0ubuntu27.3

python-apport - 2.20.10-0ubuntu27.3

python3-apport - 2.20.10-0ubuntu27.3

Ubuntu 18.04 LTS

apport - 2.20.9-0ubuntu7.9

python-apport - 2.20.9-0ubuntu7.9

python3-apport - 2.20.9-0ubuntu7.9

Ubuntu 16.04 LTS

apport - 2.20.1-0ubuntu2.21

python-apport - 2.20.1-0ubuntu2.21

python3-apport - 2.20.1-0ubuntu2.21

apport (Ubuntu package) - addressed in versions 2.20.1-0ubuntu2.21, 2.20.9-0ubuntu7.9, 2.20.10-0ubuntu27.3, 2.20.11-0ubuntu8.2, 2.20.1-0ubuntu2.22, 2.20.1-0ubuntu2.27, 2.20.9-0ubuntu7.12, 2.20.9-0ubuntu7.20, 2.20.11-0ubuntu8.6, 2.20.11-0ubuntu27.12, 2.20.11-0ubuntu50.1
python3-apport (Ubuntu package) - addressed in versions 2.14.1-0ubuntu3.29+esm3, 2.20.1-0ubuntu2.27, 2.20.9-0ubuntu7.20, 2.20.11-0ubuntu27.12, 2.20.11-0ubuntu50.1
python-apport (Ubuntu package) - addressed in versions 2.20.1-0ubuntu2.27, 2.20.9-0ubuntu7.20

• https://usn.ubuntu.com/4171-3/

• Multiple vulnerabilities in Apport for Ubuntu
• Ubuntu 14.04 ESM update for Apport
• Ubuntu regression update for Apport
• Ubuntu update for apport