apport 2.20.1-0ubuntu2.20 source package in Ubuntu
Changelog
apport (2.20.1-0ubuntu2.20) xenial-security; urgency=medium
* SECURITY UPDATE: apport reads arbitrary files if ~/.config/apport/settings
is a symlink (LP: #1830862)
- apport/fileutils.py: drop permissions before reading user settings file.
- CVE-2019-11481
* SECURITY UPDATE: TOCTTOU race conditions and following symbolic
links when creating a core file (LP: #1839413)
- data/apport: use file descriptor to reference to cwd instead
of strings.
- CVE-2019-11482
* SECURITY UPDATE: fully user controllable lock file due to lock file
being located in world-writable directory (LP: #1839415)
- data/apport: create and use lock file from /var/lock/apport.
- CVE-2019-11485
* SECURITY UPDATE: per-process user controllable Apport socket file
(LP: #1839420)
- data/apport: forward crashes only under a valid uid and gid,
thanks Stéphane Graber for the patch.
- CVE-2019-11483
* SECURITY UPDATE: PID recycling enables an unprivileged user to
generate and read a crash report for a privileged process (LP: #1839795)
- data/apport: drop permissions before adding proc info (special thanks
to Kevin Backhouse for the patch)
- data/apport, apport/report.py, apport/ui.py: only access or open
/proc/[pid] through a file descriptor for that directory.
- CVE-2019-15790
-- Tiago Stürmer Daitx <email address hidden> Tue, 29 Oct 2019 05:23:08 +0000
Upload details
- Uploaded by:
- Tiago Stürmer Daitx
- Sponsored by:
- Alex Murray
- Uploaded to:
- Xenial
- Original maintainer:
- Martin Pitt
- Architectures:
- all
- Section:
- utils
- Urgency:
- Medium Urgency
See full publishing history Publishing
| Series | Published | Component | Section |
|---|
Downloads
| File | Size | SHA-256 Checksum |
|---|---|---|
| apport_2.20.1.orig.tar.gz | 1.3 MiB | 638930a4b5a44fe3b9c56dd94cc72d5ebc225fd3e29f6043c63e47f66d658e06 |
| apport_2.20.1-0ubuntu2.20.diff.gz | 167.2 KiB | 0e2d5430d302dc44a43c9aee28dd94b78905af72323b7754f383abc7d20bef56 |
| apport_2.20.1-0ubuntu2.20.dsc | 2.5 KiB | b74c33e64489b01b88e60d71baea0fc2dd834718a237c81f23be4e6cf2e11da3 |
Available diffs
Binary packages built by this source
- apport: automatically generate crash reports for debugging
apport automatically collects data from crashed processes and
compiles a problem report in /var/crash/. This utilizes the crashdump
helper hook provided by the Ubuntu kernel.
.
This package also provides a command line frontend for browsing and
handling the crash reports. For desktops, you should consider
installing the GTK+ or Qt user interface (apport-gtk or apport-kde).
- apport-gtk: GTK+ frontend for the apport crash report system
apport automatically collects data from crashed processes and
compiles a problem report in /var/crash/. This utilizes the crashdump
helper hook provided by the Ubuntu kernel.
.
This package provides a GTK+ frontend for browsing and handling the
crash reports.
- apport-kde: KDE frontend for the apport crash report system
apport automatically collects data from crashed processes and
compiles a problem report in /var/crash/. This utilizes the crashdump
helper hook provided by the Ubuntu kernel.
.
This package provides a KDE frontend for browsing and handling the
crash reports.
- apport-noui: tools for automatically reporting Apport crash reports
apport automatically collects data from crashed processes and
compiles a problem report in /var/crash/. This utilizes the crashdump
helper hook provided by the Ubuntu kernel.
.
Installing this package will configure your system to automatically submit
all new Apport crash reports.
- apport-retrace: tools for reprocessing Apport crash reports
apport-retrace recombines an Apport crash report (either a file or a
Launchpad bug) and debug symbol packages (.ddebs) into fully symbolic
stack traces. This can optionally use a sandbox for installing debug symbol
packages and doing the processing, so that entire process of retracing crashes
can happen with normal user privileges without changing the system.
.
You need to install gdb-multiarch if you want to be able to retrace crash
reports which happened on a different architecture than the one you run
apport-retrace on.
- apport-valgrind: valgrind wrapper that first downloads debug symbols
apport-valgrind is a valgrind wrapper that automatically downloads related
available debug symbols and provides them to valgrind's memcheck tool, which
is executed. The output is a valgrind log file ("valgrind.log") that contains
stack traces (with as many symbols resolved as available) and that shows
memory leaks.
- dh-apport: debhelper extension for the apport crash report system
apport automatically collects data from crashed processes and
compiles a problem report in /var/crash/. This utilizes the crashdump
helper hook provided by the Ubuntu kernel.
.
This package provides a debhelper extension to make it easier for other
packages to include apport hooks.
- python-apport: Python library for Apport crash report handling
This Python package provides high-level functions for creating and
handling apport crash reports:
.
* Query available and new reports.
* Add OS, packaging, and process runtime information to a report.
* Various frontend utility functions.
* Python hook to generate crash reports when Python scripts fail.
- python-problem-report: Python library to handle problem reports
This Python library provides an interface for creating, modifying,
and accessing standardized problem reports for program and kernel
crashes and packaging bugs.
.
These problem reports use standard Debian control format syntax
(RFC822).
- python3-apport: Python 3 library for Apport crash report handling
This Python package provides high-level functions for creating and
handling apport crash reports:
.
* Query available and new reports.
* Add OS, packaging, and process runtime information to a report.
* Various frontend utility functions.
* Python hook to generate crash reports when Python scripts fail.
- python3-problem-report: Python 3 library to handle problem reports
This Python library provides an interface for creating, modifying,
and accessing standardized problem reports for program and kernel
crashes and packaging bugs.
.
These problem reports use standard Debian control format syntax
(RFC822).
