CVE-2017-14177

Publication date 15 November 2017

Last updated 25 August 2025

Ubuntu priority

High

Why this priority?

Cvss 3 Severity Score

7.8 · High

Score breakdown

Description

Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1324.

Status

Package Ubuntu Release Status
apport 17.10 artful
Fixed 2.20.7-0ubuntu3.4
17.04 zesty
Fixed 2.20.4-0ubuntu4.7
16.04 LTS xenial
Fixed 2.20.1-0ubuntu2.12
14.04 LTS trusty
Fixed 2.14.1-0ubuntu3.27

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
apport

Severity score breakdown

CVSS version: CVSS v3.0

Base score 7.8 · High

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-3480-1
    • Apport vulnerabilities
    • 15 November 2017

Other references

Access our resources on patching vulnerabilities