CVE-2019-7307 Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml

What is CVE-2019-7307?

CVE-2019-7307 is a medium-severity vulnerability in Ubuntu apport, published on 29 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system.

Weakness: CWE-367

Which versions are affected by CVE-2019-7307?

It affects 1 product.

Products include Apport Project Apport.

How do I fix CVE-2019-7307?

Apply the vendor's patch.

Is CVE-2019-7307 being exploited?

There is no known exploitation of CVE-2019-7307 in the wild and no public exploit code.

Other vulnerabilities in Ubuntu apport

• CVE-2022-28657 Denial of service in Apport High 7.8
• CVE-2018-6552 Apport treats the container PID as the global PID when /proc/<global_pid>/ is missing High 7.8
• CVE-2017-14177 Privilege escalation in Apport High 7.8
• CVE-2017-14179 Privilege escalation in Apport High 7.8
• CVE-2017-14180 Privilege escalation in Apport High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-75vh-qgvc-r573, UBUNTU-CVE-2019-7307, USN-4051-1, USN-4051-2.