CVE-2025-5467: Ubuntu Apport Insecure File Permissions Vulnerability

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-12-10 · updated 2026-10-14
Weakness: CWE-708

Description

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

Affected products

Canonical apport: from 2.20.1-0ubuntu1 before 2.20.1-0ubuntu2.30; from 2.20.9-0ubuntu7 before 2.20.9-0ubuntu7.29; from 2.20.11-0ubuntu27 before 2.20.11-0ubuntu27.28; from 2.20.11-0ubuntu82 before 2.20.11-0ubuntu82.7; from 2.28.1-0ubuntu1 before 2.28.1-0ubuntu3.6; from 2.32.0-0ubuntu1 before 2.32.0-0ubuntu5.1 — fixed in 2.20.1-0ubuntu2.30, 2.20.11-0ubuntu27.28, 2.20.11-0ubuntu82.7, 2.20.9-0ubuntu7.29, 2.28.1-0ubuntu3.6, 2.32.0-0ubuntu5.1

How to fix

Upgrade to a fixed version: Canonical apport 2.20.1-0ubuntu2.30, 2.20.11-0ubuntu27.28, 2.20.11-0ubuntu82.7, 2.20.9-0ubuntu7.29. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-5467 or the next vulnerability affects your stack