USN-4449-2

Dashboard / Vulnerabilities / USN-4449-2

USN-4449-2

Summary: apport vulnerabilities

Details: USN-4449-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that Apport incorrectly dropped privileges when making certain D-Bus calls. A local attacker could use this issue to read arbitrary files. (CVE-2020-11936) Seong-Joong Kim discovered that Apport incorrectly parsed configuration files. A local attacker could use this issue to cause Apport to crash, resulting in a denial of service. (CVE-2020-15701) Ryota Shiga working with Trend Micro´s Zero Day Initiative, discovered that Apport incorrectly implemented certain checks. A local attacker could use this issue to escalate privileges and run arbitrary code. (CVE-2020-15702)

References: https://ubuntu.com/security/notices/USN-4449-2, https://ubuntu.com/security/CVE-2020-11936, https://ubuntu.com/security/CVE-2020-15701, https://ubuntu.com/security/CVE-2020-15702