Ubuntu: 4051-1 Moderate: Apport Local Threat Information Exposure

ubuntu

July 9, 2019

Apport could be made to expose sensitive information in crash reports.

Summary

Apport could be made to expose sensitive information in crash reports.

Software Description:

- apport: automatically generate crash reports for debugging

Details:

Kevin Backhouse discovered a race-condition when reading the user's local

Apport configuration. This could be used by a local attacker to cause

Apport to include arbitrary files in a resulting crash report.

Topics Covered

security advisory local threat information exposure ubuntu apport

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  python-apport                   2.20.10-0ubuntu27.1
  python3-apport                  2.20.10-0ubuntu27.1

Ubuntu 18.10:
  python-apport                   2.20.10-0ubuntu13.4
  python3-apport                  2.20.10-0ubuntu13.4

Ubuntu 18.04 LTS:
  python-apport                   2.20.9-0ubuntu7.7
  python3-apport                  2.20.9-0ubuntu7.7

Ubuntu 16.04 LTS:
  python-apport                   2.20.1-0ubuntu2.19
  python3-apport                  2.20.1-0ubuntu2.19

In general, a standard system update will make all the necessary changes.