Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.10, and before 1.0-0ubuntu5.2 on Ubuntu 9.04 does not properly remove files from the applications crash-report directory, which allows local users to delete arbitrary files via unspecified vectors.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Apport | Apport | * | 0.1.0.8.1 (including) |
| Ubuntu | Ubuntu | 8.0.4_lts (including) | 8.0.4_lts (including) |
| Ubuntu | Ubuntu | 8.1.0 (including) | 8.1.0 (including) |
| Ubuntu | Ubuntu | 9.0.4 (including) | 9.0.4 (including) |
| Apport | Ubuntu | devel | * |
| Apport | Ubuntu | hardy | * |
| Apport | Ubuntu | intrepid | * |
| Apport | Ubuntu | jaunty | * |
References
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
- http://secunia.com/advisories/34947
- http://secunia.com/advisories/34952
- http://secunia.com/advisories/35065
- http://www.securityfocus.com/bid/34776
- http://www.ubuntu.com/usn/usn-768-1
- https://bugs.launchpad.net/bugs/357024
- https://launchpad.net/bugs/cve/2009-1295
- http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
- http://secunia.com/advisories/34947
- http://secunia.com/advisories/34952
- http://secunia.com/advisories/35065
- http://www.securityfocus.com/bid/34776
- http://www.ubuntu.com/usn/usn-768-1
- https://bugs.launchpad.net/bugs/357024
- https://launchpad.net/bugs/cve/2009-1295