CVE-2016-9949: Code Injection
Published Dec 17, 2016
·Updated
An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code.
Affected Software
2 affected components
Apport Project Apport<=2.20.3
Ubuntu<=12.10
Remediation
Patch Available
Event History
Dec 17, 2016
CVE Published
via MITRE·03:34 AM
Data Sourced
via MITRE·03:34 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-9949?
CVE-2016-9949 is classified as a critical vulnerability due to its potential for remote code execution.
2
How do I fix CVE-2016-9949?
To mitigate CVE-2016-9949, upgrade Apport to version 2.20.4 or later.
3
What software is affected by CVE-2016-9949?
CVE-2016-9949 affects Apport versions prior to 2.20.4 and Ubuntu Linux versions up to 12.10.
4
Can CVE-2016-9949 be exploited remotely?
Yes, CVE-2016-9949 can be exploited remotely by attackers to execute arbitrary Python code.
5
What is the impact of CVE-2016-9949?
The impact of CVE-2016-9949 allows remote attackers to gain control over affected systems through arbitrary code execution.