CVE-2025-5467: Ubuntu Apport Insecure File Permissions Vulnerability
Published Dec 10, 2025
·Updated
It was discovered that processcrash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibly exposing crash information beyond expected or intended groups.
Affected Software
7 affected components
Canonical apport
Canonical apport>=2.20.1-0ubuntu1<2.20.1-0ubuntu2.30
Canonical apport>=2.20.9-0ubuntu7<2.20.9-0ubuntu7.29
Canonical apport>=2.20.11-0ubuntu27<2.20.11-0ubuntu27.28
Canonical apport>=2.20.11-0ubuntu82<2.20.11-0ubuntu82.7
Canonical apport>=2.28.1-0ubuntu1<2.28.1-0ubuntu3.6
Canonical apport>=2.32.0-0ubuntu1<2.32.0-0ubuntu5.1
Event History
Dec 10, 2025
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
DescriptionWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-5467?
CVE-2025-5467 is classified as a medium severity vulnerability.
2
What is the main issue with CVE-2025-5467?
CVE-2025-5467 allows process_crash() in Canonical's Apport to create crash files with incorrect group ownership.
3
How could CVE-2025-5467 affect users?
CVE-2025-5467 may expose sensitive crash information to unintended groups.
4
How do I fix CVE-2025-5467?
To fix CVE-2025-5467, you should update Canonical's Apport to the latest version that addresses this vulnerability.
5
Is CVE-2025-5467 specific to any particular software?
Yes, CVE-2025-5467 specifically affects Canonical's Apport crash reporting tool.