CVE-2025-5467 - Vulnerability Details - OpenCVE

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Canonical	Apport Ubuntu

No data.

No data.

References

Link	Providers
https://bugs.launchpad.net/apport/+bug/2106338
https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/

History

Thu, 11 Dec 2025 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Canonical Canonical apport Canonical ubuntu
Vendors & Products		Canonical Canonical apport Canonical ubuntu

Wed, 10 Dec 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 10 Dec 2025 18:15:00 +0000

Type	Values Removed	Values Added
Description		It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.
Title		Ubuntu Apport Insecure File Permissions Vulnerability
Weaknesses		CWE-708
References		https://bugs.launchpad.net/apport/+bug/2106338 https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/
Metrics		cvssV4_0 `{'score': 1.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}`

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2025-12-10T18:00:35.967Z

Updated: 2025-12-10T18:45:08.960Z

Reserved: 2025-06-02T12:03:56.269Z

Link: CVE-2025-5467

Vulnrichment

Updated: 2025-12-10T18:45:05.126Z

NVD

Status : Received

Published: 2025-12-10T18:16:19.070

Modified: 2025-12-10T18:16:19.070

Link: CVE-2025-5467

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5467", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2025-06-02T12:03:56.269Z", "datePublished": "2025-12-10T18:00:35.967Z", "dateUpdated": "2025-12-10T18:45:08.960Z"}, "containers": {"cna": {"title": "Ubuntu Apport Insecure File Permissions Vulnerability", "datePublic": "2025-06-02T17:36:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-639", "descriptions": [{"lang": "en", "value": "CAPEC-639: Probe System Files"}]}], "affected": [{"vendor": "Canonical", "product": "apport", "collectionURL": "https://launchpad.net/ubuntu/+source/", "packageName": "apport", "programFiles": ["data/apport"], "programRoutines": [{"name": "process_crash()"}], "versions": [{"status": "affected", "version": "2.20.11-0ubuntu82", "lessThan": "2.20.11-0ubuntu82.7", "versionType": "dpkg"}, {"status": "affected", "version": "2.32.0", "lessThan": "2.32.0-0ubuntu5.1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.9", "lessThan": "2.20.9-0ubuntu7.29+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.28.1", "lessThan": "2.28.1-0ubuntu3.6", "versionType": "dpkg"}, {"status": "affected", "version": "2.33.0", "lessThan": "2.33.0-0ubuntu1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.1", "lessThan": "2.20.1-0ubuntu2.30+esm5", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.11-0ubuntu27", "lessThan": "2.20.11-0ubuntu27.28", "versionType": "dpkg"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups."}]}], "references": [{"url": "https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/"}, {"url": "https://bugs.launchpad.net/apport/+bug/2106338"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "baseSeverity": "LOW", "baseScore": 1.9, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}], "credits": [{"lang": "en", "value": "Rich Mirch", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2025-12-10T18:00:35.967Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-10T18:33:45.578963Z", "id": "CVE-2025-5467", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-10T18:45:08.960Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5467", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T18:33:45.578963Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-10T18:45:05.126Z"}}], "cna": {"title": "Ubuntu Apport Insecure File Permissions Vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Rich Mirch"}], "impacts": [{"capecId": "CAPEC-639", "descriptions": [{"lang": "en", "value": "CAPEC-639: Probe System Files"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Canonical", "product": "apport", "versions": [{"status": "affected", "version": "2.20.11-0ubuntu82", "lessThan": "2.20.11-0ubuntu82.7", "versionType": "dpkg"}, {"status": "affected", "version": "2.32.0", "lessThan": "2.32.0-0ubuntu5.1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.9", "lessThan": "2.20.9-0ubuntu7.29+esm1", "versionType": "dpkg"}, {"status": "affected", "version": "2.28.1", "lessThan": "2.28.1-0ubuntu3.6", "versionType": "dpkg"}, {"status": "affected", "version": "2.33.0", "lessThan": "2.33.0-0ubuntu1", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.1", "lessThan": "2.20.1-0ubuntu2.30+esm5", "versionType": "dpkg"}, {"status": "affected", "version": "2.20.11-0ubuntu27", "lessThan": "2.20.11-0ubuntu27.28", "versionType": "dpkg"}], "packageName": "apport", "programFiles": ["data/apport"], "collectionURL": "https://launchpad.net/ubuntu/+source/", "defaultStatus": "unaffected", "programRoutines": [{"name": "process_crash()"}]}], "datePublic": "2025-06-02T17:36:00.000Z", "references": [{"url": "https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/"}, {"url": "https://bugs.launchpad.net/apport/+bug/2106338"}], "descriptions": [{"lang": "en", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.", "supportingMedia": [{"type": "text/html", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2025-12-10T18:00:35.967Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5467", "state": "PUBLISHED", "dateUpdated": "2025-12-10T18:45:08.960Z", "dateReserved": "2025-06-02T12:03:56.269Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2025-12-10T18:00:35.967Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups."}], "id": "CVE-2025-5467", "lastModified": "2025-12-10T18:16:19.070", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2025-12-10T18:16:19.070", "references": [{"source": "security@ubuntu.com", "url": "https://bugs.launchpad.net/apport/+bug/2106338"}, {"source": "security@ubuntu.com", "url": "https://www.stratascale.com/resource/cve-2025-32462-ubuntu-apport-vulnerability/"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-708"}], "source": "security@ubuntu.com", "type": "Secondary"}]}