What is the severity of USN-4171-4?

The severity of USN-4171-4 is classified as important due to the regression fix in the Python Apport library.

How do I fix USN-4171-4?

To fix USN-4171-4, update the python-apport and python3-apport packages to version 2.14.1-0ubuntu3.29+esm3.

Which Ubuntu versions are affected by USN-4171-4?

USN-4171-4 affects Ubuntu 14.04 ESM users.

What was the issue in USN-4171-4?

USN-4171-4 addresses a regression in the Apport service that arose from a previous update.

Is there a backup needed before applying USN-4171-4?

It is always recommended to back up important data before applying security updates such as USN-4171-4.

Vulnerability/
USN-4171-4

5/11/2019

USN-4171-4: Apport regression

First published: Tue Nov 05 2019(Updated: )

USN-4171-1 fixed a vulnerability in Apport. The update caused a regression in the Python Apport library. This update fixes the problem for Ubuntu 14.04 ESM. We apologize for the inconvenience. Original advisory details: Kevin Backhouse discovered Apport would read its user-controlled settings file as the root user. This could be used by a local attacker to possibly crash Apport or have other unspecified consequences. (CVE-2019-11481) Sander Bos discovered a race-condition in Apport during core dump creation. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. (CVE-2019-11482) Sander Bos discovered Apport mishandled crash dumps originating from containers. This could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. (CVE-2019-11483) Sander Bos discovered Apport mishandled lock-file creation. This could be used by a local attacker to cause a denial of service against Apport. (CVE-2019-11485) Kevin Backhouse discovered Apport read various process-specific files with elevated privileges during crash dump generation. This could could be used by a local attacker to generate a crash report for a privileged process that is readable by an unprivileged user. (CVE-2019-15790)

Affected Software	Affected Version	How to fix
All of
ubuntu/python-apport	<2.14.1-0ubuntu3.29+esm3	2.14.1-0ubuntu3.29+esm3
Ubuntu OpenSSH Client	=14.04
All of
ubuntu/python3-apport	<2.14.1-0ubuntu3.29+esm3	2.14.1-0ubuntu3.29+esm3
Ubuntu OpenSSH Client	=14.04
All of
ubuntu/apport	<2.14.1-0ubuntu3.29+esm3	2.14.1-0ubuntu3.29+esm3
Ubuntu OpenSSH Client	=14.04

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of USN-4171-4?
The severity of USN-4171-4 is classified as important due to the regression fix in the Python Apport library.
How do I fix USN-4171-4?
To fix USN-4171-4, update the python-apport and python3-apport packages to version 2.14.1-0ubuntu3.29+esm3.
Which Ubuntu versions are affected by USN-4171-4?
USN-4171-4 affects Ubuntu 14.04 ESM users.
What was the issue in USN-4171-4?
USN-4171-4 addresses a regression in the Apport service that arose from a previous update.
Is there a backup needed before applying USN-4171-4?
It is always recommended to back up important data before applying security updates such as USN-4171-4.

agent/severity
agent/type
agent/last-modified-date
agent/first-publish-date
agent/event
agent/description
agent/title
agent/references
agent/source
agent/softwarecombine
agent/tags
collector/usn
source/Ubuntu
agent/software-canonical-lookup
agent/software-canonical-lookup-request
package-manager/ubuntu
vendor/ubuntu
canonical/ubuntu openssh client
version/ubuntu openssh client/14.04