CVE-2021-32554

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-59CWE-61

Affected software

VendorProductVersions
Canonicalapport>= 2.20.1, < 2.20.1-0ubuntu2.30+esm1; >= 2.20.9, < 2.20.9-0ubuntu7.24; >= 2.20.11-0ubuntu27, < 2.20.11-0ubuntu27.18; >= 2.20.11-0ubuntu50, < 2.20.11-0ubuntu50.7; >= 2.20.11-0ubuntu65, < 2.20.11-0ubuntu65.1; >= 2.14.1-0ubuntu3, < 2.14.1-0ubuntu3.29+esm7

References

Timeline

Published
Jun 12, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-325555.5It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-CVE-2021-325563.3It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in aCVE-2021-325577.1It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks.CVE-2021-325587.5An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and CertifCVE-2021-325596.5An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that wCVE-2021-32566.5KuaiFanCMS V5.x contains an arbitrary file read vulnerability in the html_url parameter of the chakanhtml.module.php file.CVE-2021-325606.5The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.CVE-2021-325616.1OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.CVE-2021-325639.8An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delCVE-2021-325657.5Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache CVE-2021-325667.5Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache TCVE-2021-325677.5Improper Input Validation vulnerability in HTTP/2 of Apache Traffic Server allows an attacker to DOS the server. This issue affects Apache T
CVE-2021-32554: Medium severity, CVSS 5.5 | Vulnix