CVE-2016-9951

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in `RespawnCommand` or `ProcCmdline` fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the Relaunch button on Apport crash files generated by local systems. The Relaunch button will be hidden when crash files are opened directly in Apport-GTK.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/95011Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3157-1
https://bugs.launchpad.net/apport/+bug/1648806Issue Tracking, Patch
https://donncha.is/2016/12/compromising-ubuntu-desktop/Exploit, Technical Description, Third Party Advisory
https://github.com/DonnchaC/ubuntu-apport-exploitationIssue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/40937/
http://www.securityfocus.com/bid/95011Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-3157-1
https://bugs.launchpad.net/apport/+bug/1648806Issue Tracking, Patch
https://donncha.is/2016/12/compromising-ubuntu-desktop/Exploit, Technical Description, Third Party Advisory
https://github.com/DonnchaC/ubuntu-apport-exploitationIssue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/40937/

Timeline

Published: Dec 17, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-99528.1The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba CVE-2016-99539.8The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS ba CVE-2016-99547.5The backtrack compilation code in the Irregex package (aka IrRegular Expressions) before 0.9.6 for Scheme allows remote attackers to cause a CVE-2016-99556.3The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 re CVE-2016-99567.5The route manager in FlightGear before 2016.4.4 allows remote attackers to write to arbitrary files via a crafted Nasal script.CVE-2016-99577.8Stack-based buffer overflow in game-music-emu before 0.6.1.CVE-2016-99587.8game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.CVE-2016-99597.8game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.CVE-2016-99605.5game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash).CVE-2016-99619.8game-music-emu before 0.6.1 mishandles unspecified integer values.CVE-2016-99626.4RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of CVE-2016-99635.9Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.