NetSight
IP …
high7.8Public exploit code

CVE-2016-9950

An issue was discovered in Apport before 2.20.4.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.

Affected products

VendorProductAffected versions
Apport ProjectApport
through 2.20.3
CanonicalUbuntu Linux
through 12.10

Weakness classification

CWE-22

References