CVE-2025-5467

It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.

Scoring

Severity

LOW

CVSS base score

1.9

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

EPSS probability

0.18%

CWE

CWE-708

Published

2025-12-10

Last modified

2026-03-13

Affected products

• Canonical apport
• Canonical apport
• Canonical apport
• Canonical apport
• Canonical apport
• Canonical apport
• Canonical apport

Weakness type

• CWE-708

Related vulnerabilities

• CVE-2026-6469 — PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership
• CVE-2026-40196 — HomeBox has Unauthorized API Access via Retained defaultGroup ID After Group Access Revocation
• CVE-2026-32691 — Timing ownership claim attack on new external back-end secrets
• CVE-2025-14262 — Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
• CVE-2025-5069 — Incorrect Ownership Assignment in GitLab
• CVE-2024-52561 — A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for...
• CVE-2024-45417 — Zoom Apps for macOS - Uncontrolled Resource Consumption
• CVE-2024-45426 — Zoom Workplace Apps - Incorrect Ownership Assignment

Markdown version · Browse all CVEs