UBUNTU-CVE-2019-7307

    Dashboard / Vulnerabilities / UBUNTU-CVE-2019-7307

    UBUNTU-CVE-2019-7307

    Published: 9 Jul 2019Last Modified: 4 Feb 2026
    Upstream:
    CVE-2019-7307

    Summary:

    Details: Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system.

    References: https://ubuntu.com/security/CVE-2019-7307, https://ubuntu.com/security/notices/USN-4051-1, https://ubuntu.com/security/notices/USN-4051-2, https://www.cve.org/CVERecord?id=CVE-2019-7307

    Affected packages

    Package

    Name: apport

    Purl: pkg:deb/ubuntu/[email protected]+esm1?arch=source&distro=trusty/esm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.14.1-0ubuntu3.29+esm1

    Affected versions

    2.12.5-0ubuntu2
    2.12.6-0ubuntu1
    2.12.7-0ubuntu1
    2.12.7-0ubuntu2
    2.12.7-0ubuntu3
    2.12.7-0ubuntu6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High