CVE-2025-5467CWE-708

CVE-2025-5467

Low · published December 10, 2025

CVSS v3.1
3.3
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.6th percentile
Weakness
CWE-708 · Incorrect Ownership Assignment
Published
2025-12-10T23:16Z
Affected products (6)
ProductVersionsFixed in
canonical/apport≥ 2.20.1-0ubuntu1, < 2.20.1-0ubuntu2.302.20.1-0ubuntu2.30
canonical/apport≥ 2.20.9-0ubuntu7, < 2.20.9-0ubuntu7.292.20.9-0ubuntu7.29
canonical/apport≥ 2.20.11-0ubuntu27, < 2.20.11-0ubuntu27.282.20.11-0ubuntu27.28
canonical/apport≥ 2.20.11-0ubuntu82, < 2.20.11-0ubuntu82.72.20.11-0ubuntu82.7
canonical/apport≥ 2.28.1-0ubuntu1, < 2.28.1-0ubuntu3.62.28.1-0ubuntu3.6
canonical/apport≥ 2.32.0-0ubuntu1, < 2.32.0-0ubuntu5.12.32.0-0ubuntu5.1
References (2)
https://bugs.launchpad.net/apport/+bug/2106338 · [email protected]https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/ · [email protected]
EPSS history
Timeline
  • 10 DEC 18:00Z
    Ubuntu Apport Insecure File Permissions Vulnerability
    cvelistv5