CVE-2017-14177

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-02 · updated 2026-06-17
Weakness: CWE-400

Description

Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1324.

Affected products

Apport: through 2.20.7
Canonical Ubuntu Linux: 14.04, 16.04, 17.04, 17.10, 18.04

References

https://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3171
https://launchpad.net/bugs/1726372
https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14177
https://usn.ubuntu.com/usn/usn-3480-1
https://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3171
https://launchpad.net/bugs/1726372
https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14177
https://usn.ubuntu.com/usn/usn-3480-1

Get alerted when CVE-2017-14177 or the next vulnerability affects your stack