CVE-2012-0949

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/82020
http://secunia.com/advisories/49230Vendor Advisory
http://www.securityfocus.com/bid/53605
http://www.ubuntu.com/usn/USN-1443-1Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/75728
http://osvdb.org/82020
http://secunia.com/advisories/49230Vendor Advisory
http://www.securityfocus.com/bid/53605
http://www.ubuntu.com/usn/USN-1443-1Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/75728

Timeline

Published: May 31, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-09505.0The Apport hook (DistUpgradeApport.py) in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade d CVE-2012-09517.8A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry CVE-2012-09525.0A heap buffer overflow was discovered in the device control ioctl in the Linux driver for Nvidia graphics cards, which may allow an attacker CVE-2012-09535.0A race condition was discovered in the Linux drivers for Nvidia graphics which allowed an attacker to exfiltrate kernel memory to userspace.CVE-2012-09542.6APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and do CVE-2012-09557.4software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py CVE-2012-09566.8ubiquity-slideshow-ubuntu before 58.2, during installation, allows remote man-in-the-middle attackers to execute arbitrary web script or HTM CVE-2012-09574.9The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kern CVE-2012-09584.3content/unity-api.js in the unity-firefox-extension extension 2.4.1 for Firefox exposes the toDataURL function in an API call, which allows CVE-2012-09592.1Remote Login Service (RLS) 1.0.0 does not properly clear account information when switching users, which might allow physically proximate us CVE-2012-09607.5Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attac CVE-2012-09612.1Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.