USN-3480-2: Apport regressions
USN-3480-1 fixed vulnerabilities in Apport. The fix for CVE-2017-14177 introduced a regression in the ability to handle crashes for users that configured their systems to use the Upstart init system in Ubuntu 16.04 LTS and Ubuntu 17.04. The fix for CVE-2017-14180 temporarily disabled crash forwarding to containers. This update addresses the problems. We apologize for the inconvenience. Original advisory details: Sander Bos discovered that Apport incorrectly handled core dumps for setuid binaries. A local attacker could use this issue to perform a denial of service via resource exhaustion or possibly gain root privileges. (CVE-2017-14177) Sander Bos discovered that Apport incorrectly handled core dumps for processes in a different PID namespace. A local attacker could use this issue to perform a denial of service via resource exhaustion or possibly gain root privileges. (CVE-2017-14180)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-3480-2?
USN-3480-2 addresses vulnerabilities that could impact system stability and user experience.
How do I fix USN-3480-2?
To fix USN-3480-2, update the Apport package to the recommended version based on your Ubuntu system.
What systems are affected by USN-3480-2?
USN-3480-2 affects Ubuntu 16.04 LTS, 17.04, and 17.10 users utilizing specific versions of the Apport package.
What issues does USN-3480-2 resolve?
USN-3480-2 resolves a regression issue with crash handling for systems using the Upstart init system.
Is it necessary to reboot after applying USN-3480-2?
Rebooting is generally recommended after applying patches like USN-3480-2 to ensure all changes take effect.