CVE-2025-5467

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugs.launchpad.net/apport/+bug/2106338	Exploit Third Party Advisory
https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:canonical:apport::::::::
	cpe:2.3:a:canonical:apport::::::::
	cpe:2.3:a:canonical:apport::::::::
	cpe:2.3:a:canonical:apport::::::::
	cpe:2.3:a:canonical:apport::::::::
	cpe:2.3:a:canonical:apport::::::::

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió que process_crash() en data/apport, dentro de la herramienta de informes de fallos Apport de Canonical, puede crear archivos de fallo con una propiedad de grupo incorrecta, posiblemente exponiendo información de fallo más allá de los grupos esperados o previstos.

Information

Published : 2025-12-10 18:16

Updated : 2026-10-14 21:10

NVD link : CVE-2025-5467

Mitre link : CVE-2025-5467

CVE.ORG link : CVE-2025-5467

JSON object : View

Products Affected

canonical

apport

CWE

CWE-708

Incorrect Ownership Assignment

{"id": "CVE-2025-5467", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5467", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T18:33:45.578963Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"vendor": "Canonical", "product": "apport", "versions": [{"status": "affected", "version": "2.20.11-0ubuntu82", "lessThan": "2.20.11-0ubuntu82.7", "versionType": "dpkg"}, {"status": "affected", "version": "2.32.0", "lessThan": "2.32.0-0ubuntu5.1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.9", "lessThan": "2.20.9-0ubuntu7.29+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.28.1", "lessThan": "2.28.1-0ubuntu3.6", "versionType": "dpkg"}, {"status": "affected", "version": "2.33.0", "lessThan": "2.33.0-0ubuntu1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.1", "lessThan": "2.20.1-0ubuntu2.30+esm5", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.11-0ubuntu27", "lessThan": "2.20.11-0ubuntu27.28", "versionType": "dpkg"}], "packageName": "apport", "programFiles": ["data/apport"], "collectionURL": "https://launchpad.net/ubuntu/+source/", "defaultStatus": "unaffected", "programRoutines": [{"name": "process_crash()"}]}]}], "published": "2025-12-10T18:16:19.070", "references": [{"url": "https://bugs.launchpad.net/apport/+bug/2106338", "tags": ["Exploit", "Third Party Advisory"], "source": "security@ubuntu.com"}, {"url": "https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/", "tags": ["Exploit", "Third Party Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-708"}]}], "descriptions": [{"lang": "en", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups."}, {"lang": "es", "value": "Se descubri\u00f3 que process_crash() en data/apport, dentro de la herramienta de informes de fallos Apport de Canonical, puede crear archivos de fallo con una propiedad de grupo incorrecta, posiblemente exponiendo informaci\u00f3n de fallo m\u00e1s all\u00e1 de los grupos esperados o previstos."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FDEF7B7-318E-4C9B-AA8B-79157E87B4EF", "versionEndExcluding": "2.20.1-0ubuntu2.30", "versionStartIncluding": "2.20.1-0ubuntu1"}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3E142C34-69E2-4AC5-9770-9D8C978AD4DE", "versionEndExcluding": "2.20.9-0ubuntu7.29", "versionStartIncluding": "2.20.9-0ubuntu7"}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9AAE270-D1C4-4A3D-8460-818589BC9C44", "versionEndExcluding": "2.20.11-0ubuntu27.28", "versionStartIncluding": "2.20.11-0ubuntu27"}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FD1656C-892E-4C03-81BD-9AC9CDE8DA1B", "versionEndExcluding": "2.20.11-0ubuntu82.7", "versionStartIncluding": "2.20.11-0ubuntu82"}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFA5AA56-DA6D-4656-A71D-ECA4CC330E80", "versionEndExcluding": "2.28.1-0ubuntu3.6", "versionStartIncluding": "2.28.1-0ubuntu1"}, {"criteria": "cpe:2.3:a:canonical:apport:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFAE79F8-E43C-42F8-81FB-49EECB97555C", "versionEndExcluding": "2.32.0-0ubuntu5.1", "versionStartIncluding": "2.32.0-0ubuntu1"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}