Maik Münch

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A use-after-free issue exists in the kernel handler for IPV6 MSFILTER. The handler drops a serializing lock to copy the source-filter list from userspace and subsequently reacquires it. This creates a window where another thread can free the multicast filter structure, resulting in a stale pointer to freed memory. An unprivileged local user can exploit this condition to escalate privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** apport versions prior to 2.14.1-0ubuntu3.29+esm8 apport versions prior to 2.20.1-0ubuntu2.30+esm2 apport versions prior to 2.20.9-0ubuntu7.26 apport versions prior to 2.20.11-0ubuntu27.20 apport versions prior to 2.20.11-0ubuntu65.3 **Description** The issue is related to the `read file` function in the apport error registration service, which is associated with incorrect restriction of the path name to a directory with limited access. This can allow an attacker to disclose protected information via path traversal. The `read file` function in `apport/hookutils.py` is specifically affected. **Recommendations** For apport versions prior to 2.14.1-0ubuntu3.29+esm8, update to version 2.14.1-0ubuntu3.29+esm8 or later. For apport versions prior to 2.20.1-0ubuntu2.30+esm2, update to version 2.20.1-0ubuntu2.30+esm2 or later. For apport versions prior to 2.20.9-0ubuntu7.26, update to version 2.20.9-0ubuntu7.26 or later. For apport versions prior to 2.20.11-0ubuntu27.20, update to version 2.20.11-0ubuntu27.20 or later. For apport versions prior to 2.20.11-0ubuntu65.3, update to version 2.20.11-0ubuntu65.3 or later.

**Name of the Vulnerable Software and Affected Versions** apport versions prior to 2.14.1-0ubuntu3.29+esm8 apport versions prior to 2.20.1-0ubuntu2.30+esm2 apport versions prior to 2.20.9-0ubuntu7.26 apport versions prior to 2.20.11-0ubuntu27.20 apport versions prior to 2.20.11-0ubuntu65.3 **Description** The issue is related to the `check attachment for errors()` function in the `data/general-hooks/ubuntu.py` file of the apport error registration service in the Ubuntu operating system. This function is associated with a potential information leak about files and directories. An attacker could exploit this issue by constructing a crash file to expose protected information. **Recommendations** For apport versions prior to 2.14.1-0ubuntu3.29+esm8, update to version 2.14.1-0ubuntu3.29+esm8 or later. For apport versions prior to 2.20.1-0ubuntu2.30+esm2, update to version 2.20.1-0ubuntu2.30+esm2 or later. For apport versions prior to 2.20.9-0ubuntu7.26, update to version 2.20.9-0ubuntu7.26 or later. For apport versions prior to 2.20.11-0ubuntu27.20, update to version 2.20.11-0ubuntu27.20 or later. For apport versions prior to 2.20.11-0ubuntu65.3, update to version 2.20.11-0ubuntu65.3 or later.