CVE-2017-10708

HIGH

Apport < 2.20.6 - Remote Code Execution via Path Traversal in ExecutablePath Field

Title source: llm
STIX 2.1

Description

An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific hooks without protecting against path traversal. This allows remote attackers to execute arbitrary code via a crafted .crash file.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_confirm
https://launchpad.net/ubuntu/+source/apport/+changelog
Third Party Advisory x_refsource_confirm
https://launchpad.net/bugs/1700573

Scores

CVSS v3 7.8
EPSS 0.0210
EPSS Percentile 79.4%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-22
Status published
Products (1)
apport_project/apport < 2.20.6
Published Jul 18, 2017
Tracked Since Feb 18, 2026