CVE-2015-1341

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Any Python module in sys.path can be imported if the command line of the process triggering the coredump is Python and the first argument is -m in Apport before 2.19.2 function _python_module_path.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

VendorProductVersions
UbuntuApport>= unspecified, < 2.0.1-0ubuntu17.13; >= unspecified, < 2.19.1-0ubuntu4; >= unspecified, < 2.17.2-0ubuntu1.7; >= unspecified, < 2.14.1-0ubuntu3.18; >= unspecified, < 2.19.2

References

Timeline

Published
Apr 22, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-13424.6LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updatCVE-2015-13435.3All versions of unity-scope-gdrive logs search terms to syslog.CVE-2015-13447.2The do_write_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges CVE-2015-13452.1The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and CVE-2015-13467.5Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause CVE-2015-13474.3Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web scriptCVE-2015-13487.8Heap-based buffer overflow in Aruba Instant (IAP) with firmware before 4.0.0.7 and 4.1.x before 4.1.1.2 allows remote attackers to cause a dCVE-2015-13495.4named in ISC BIND 9.7.0 through 9.9.6 before 9.9.6-P2 and 9.10.x before 9.10.1-P2, when DNSSEC validation and the managed-keys feature are eCVE-2015-13505.5The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extCVE-2015-13517.5Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allowsCVE-2015-13525.0The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for CVE-2015-13552.1Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cl
CVE-2015-1341: High severity, CVSS 7.8 | Vulnix