UBUNTU-CVE-2020-15702

    Dashboard / Vulnerabilities / UBUNTU-CVE-2020-15702

    UBUNTU-CVE-2020-15702

    Published: 4 Aug 2020Last Modified: 4 Feb 2026
    Upstream:
    CVE-2020-15702

    Summary:

    Details: TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24, 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234.

    References: https://ubuntu.com/security/CVE-2020-15702, https://ubuntu.com/security/notices/USN-4449-1, https://ubuntu.com/security/notices/USN-4449-2, https://www.cve.org/CVERecord?id=CVE-2020-15702

    Affected packages

    Package

    Name: apport

    Purl: pkg:deb/ubuntu/[email protected]+esm5?arch=source&distro=trusty/esm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.14.1-0ubuntu3.29+esm5

    Affected versions

    2.12.5-0ubuntu2
    2.12.6-0ubuntu1
    2.12.7-0ubuntu1
    2.12.7-0ubuntu2
    2.12.7-0ubuntu3
    2.12.7-0ubuntu6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2020-15702 | CVE-DB