CVE-2025-5467: apport from 2.20.1-0ubuntu1 (inclusive), before 2.20.1-0ubuntu2.30 (exclusive), from 2.20.9-0ubuntu7 (inclusive)…

Affected technology

apport · from 2.20.1-0ubuntu1 (inclusive), before 2.20.1-0ubuntu2.30 (exclusive)
canonical

apport · from 2.20.9-0ubuntu7 (inclusive), before 2.20.9-0ubuntu7.29 (exclusive)
canonical

apport · from 2.20.11-0ubuntu27 (inclusive), before 2.20.11-0ubuntu27.28 (exclusive)
canonical

apport · from 2.20.11-0ubuntu82 (inclusive), before 2.20.11-0ubuntu82.7 (exclusive)
canonical

apport · from 2.28.1-0ubuntu1 (inclusive), before 2.28.1-0ubuntu3.6 (exclusive)
canonical

apport · from 2.32.0-0ubuntu1 (inclusive), before 2.32.0-0ubuntu5.1 (exclusive)
canonical

apport · 2.20.11-0ubuntu82 to before 2.20.11-0ubuntu82.7, 2.32.0 to before 2.32.0-0ubuntu5.1, 2.20.9 to before 2.20.9-0ubuntu7.29+esm1, 2.28.1 to before 2.28.1-0ubuntu3.6, 2.33.0 to before 2.33.0-0ubuntu1, 2.20.1 to before 2.20.1-0ubuntu2.30+esm5, 2.20.11-0ubuntu27 to before 2.20.11-0ubuntu27.28
Canonical

Component: Not specified by the source
Function: process_crash()
File: data/apport

Attack conditions (Vendor/CNA, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 1.9/10) rates confidentiality impact as low; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.