Skip to content
Fencer Vulns
medium 5.9

CVE-2017-6507 json

An issue was discovered in AppArmor before 2.12.

published 2017-03-24 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-15563

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

An issue was discovered in AppArmor before 2.12. Incorrect handling of unknown AppArmor profiles in AppArmor init scripts, upstart jobs, and/or systemd unit files allows an attacker to possibly have increased attack surfaces of processes that were intended to be confined by AppArmor. This is due to the common logic to handle 'restart' operations removing AppArmor profiles that aren't found in the typical filesystem locations, such as /etc/apparmor.d/. Userspace projects that manage their own AppArmor profiles in atypical directories, such as what's done by LXD and Docker, are affected by this flaw in the AppArmor init script logic.

Patch / fix

  • apparmor Debian 14, Debian 13, Debian 12 2.11.0-3

debian advisories DEBIAN-CVE-2017-6507

  • apparmor Ubuntu 14.04 LTS 2.10.95-0ubuntu2.6~14.04.1
  • apparmor Ubuntu 16.04 LTS 2.10.95-0ubuntu2.6

ubuntu advisories UBUNTU-CVE-2017-6507

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • apparmor SLES for SAP 12 SP2, SLES for SAP 12 SP1, SLES for Raspberry Pi 12 SP2 +6 more 2.8.2-54.1

suse advisories SUSE-SU-2017:1151-1

Exploit prediction

1.59% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.