What’s Vulnerable › Vulnerabilities

CVE-2016-9950

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-12-17 · updated 2026-06-17
• Weakness: CWE-22

Description

An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.

Affected products

• Apport: through 2.20.3
• Canonical Ubuntu Linux: through 12.10

References

• http://www.securityfocus.com/bid/95011
• http://www.ubuntu.com/usn/USN-3157-1
• https://bugs.launchpad.net/apport/+bug/1648806
• https://donncha.is/2016/12/compromising-ubuntu-desktop/
• https://github.com/DonnchaC/ubuntu-apport-exploitation
• https://www.exploit-db.com/exploits/40937/
• http://www.securityfocus.com/bid/95011
• http://www.ubuntu.com/usn/USN-3157-1
• https://bugs.launchpad.net/apport/+bug/1648806
• https://donncha.is/2016/12/compromising-ubuntu-desktop/
• https://github.com/DonnchaC/ubuntu-apport-exploitation
• https://www.exploit-db.com/exploits/40937/

Get alerted when CVE-2016-9950 or the next vulnerability affects your stack