Vulnerability record · CVE-2017-10708 · published 18 July 2017

CVE-2017-10708: Apport project apport path traversal vulnerability

Apport Project · Apport

An issue was discovered in Apport through 2.20.x. In apport/report.py, Apport sets the ExecutablePath field and it then uses the path to run package specific hooks without protecting against path traversal. This allows remote attackers to execute arbitrary code via a crafted .crash file.

7.8 CVSS 3.0 High EPSS 2.1% · top 19.0% CWE-22 · Path traversal

7.8CVSS 3.0 base score, v2 6.8

2.1%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Apport Apport Project

References

Link	Tags
https://launchpad.net/bugs/1700573	Third Party Advisory
https://launchpad.net/ubuntu/+source/apport/+changelog	Third Party Advisory
https://launchpad.net/bugs/1700573	Third Party Advisory
https://launchpad.net/ubuntu/+source/apport/+changelog	Third Party Advisory

Track CVE-2017-10708 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2022-28657Apport project apport uncontrolled resource consumption vulnerabilityApport does not disable python crash handler before entering chrootEPSS 0.23%4 Jun 2024 7.8CVE-2019-11481Canonical ubuntu linux link following vulnerabilityKevin Backhouse discovered that apport would read a user-supplied configuration file with elevated privileges. By replacing the file with a symbolic …EPSS 0.45%8 Feb 2020 7.8CVE-2018-6552Apport project apport vulnerabilityApport does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could…EPSS 0.39%31 May 2018 7.8CVE-2017-14177Apport project apport uncontrolled resource consumption vulnerabilityApport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker…EPSS 0.39%2 Feb 2018 7.8CVE-2017-14179Apport project apport uncontrolled resource consumption vulnerabilityApport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an at…EPSS 0.36%2 Feb 2018 7.8CVE-2017-14180Apport project apport uncontrolled resource consumption vulnerabilityApport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root whi…EPSS 0.44%2 Feb 2018 7.8CVE-2016-9949Apport project apport code injection vulnerabilityAn issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it…EPSS 18%17 Dec 2016 7.8CVE-2016-9950Apport project apport path traversal vulnerabilityAn issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These…EPSS 6.5%17 Dec 2016

Source: NIST National Vulnerability Database (record CVE-2017-10708), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.