CVE-2019-7307 json
Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml
published 2019-08-29 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-16851
- cvss
- 6.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system.
Patch / fix
- apport Ubuntu 16.04 LTS 2.20.1-0ubuntu2.19
- apport Ubuntu 18.04 LTS 2.20.9-0ubuntu7.7
- apport Ubuntu Pro 14.04 LTS 2.14.1-0ubuntu3.29+esm1
ubuntu advisories UBUNTU-CVE-2019-7307
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- bugs.launchpad.net https://bugs.launchpad.net/ubuntu/%2Bsource/apport/%2Bbug/1830858 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- Ubuntu apport
Classification
- Weakness
-
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
References
-
bugs.launchpad.net
/ubuntu/%2Bsource/apport/%2Bbug/1830858
exploit, issue-tracking, vendor-advisory
-
people.canonical.com
/~ubuntu-security/cve/2019/CVE-2019-7307.html
vendor-advisory
- packetstormsecurity.com /files/172858/Ubuntu-Apport-Whoopsie-DoS-Integer-Overflow.html
Sources
- CVE List CVE-2019-7307
- NVD CVE-2019-7307
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.