CVE-2019-11481

Apport reads arbitrary files if ~/.config/apport/settings is a symlink

Low · published February 8, 2020

CVSS v3.1
3.8
EPSS
0%
Percentile
38.4
In the wild
Unconfirmed
What it is

Kevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic link, a user could get apport to read any file on the system as root, with unknown consequences.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00453 · 38.4th percentile
Published
2020-02-08T04:50Z
EPSS history
Timeline
  • 08 FEB 04:50Z
    Apport reads arbitrary files if ~/.config/apport/settings is a symlink
    cvelistv5