Every CVE Search/ Get API key

CVE-2021-32554

apport read_file() function could follow maliciously constructed symbolic links

7.3 HighFix available

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
Low

Exploit likelihood

0.29%Up 0.1 points since Jun 12, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.3

apport read_file() function could follow maliciously constructed symbolic links

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Record
CVE-2021-32554
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Weakness
CWE-59, CWE-61
Updated
2026-11-02
EUVDEUVD-2021-19399 7.3

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Record
EUVD-2021-19399
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-q89m-78v7-wxvj No score

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open...

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Record
GHSA-q89m-78v7-wxvj
Weakness
CWE-59
Updated
2026-11-02
NVD 7.3

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Record
CVE-2021-32554
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-59, CWE-61
Updated
2026-11-02
OSVUBUNTU-CVE-2021-32554 5.5

It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.

Record
UBUNTU-CVE-2021-32554
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
7.3 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Updated
2026-11-02
OSVUSN-4965-1 No score

apport vulnerabilities

Maik Münch discovered that Apport incorrectly handled certain information gathering operations. A local attacker could use these issues to read and write arbitrary files as an administrator, and possibly escalate privileges.

Record
USN-4965-1
Updated
2026-11-02
OSVUSN-4965-2 No score

apport vulnerabilities

USN-4965-1 fixed several vulnerabilities in Apport. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details:

Maik Münch discovered that Apport incorrectly handled certain information gathering operations. A local attacker could use these issues to read and write arbitrary files as an administrator, and possibly escalate privileges.

Record
USN-4965-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apport
Ubuntu:Pro:14.04:LTS
 before 2.14.1-0ubuntu3.29+esm7, plus listed versions
2.12.5-0ubuntu22.12.6-0ubuntu12.12.7-0ubuntu12.12.7-0ubuntu22.12.7-0ubuntu3
Show 43 moreShow less
2.12.7-0ubuntu62.13.1-0ubuntu12.13.1-0ubuntu22.13.2-0ubuntu22.13.2-0ubuntu32.13.2-0ubuntu42.13.2-0ubuntu52.13.3-0ubuntu12.14-0ubuntu12.14.1-0ubuntu12.14.1-0ubuntu22.14.1-0ubuntu32.14.1-0ubuntu3.12.14.1-0ubuntu3.22.14.1-0ubuntu3.32.14.1-0ubuntu3.42.14.1-0ubuntu3.52.14.1-0ubuntu3.62.14.1-0ubuntu3.72.14.1-0ubuntu3.82.14.1-0ubuntu3.92.14.1-0ubuntu3.102.14.1-0ubuntu3.112.14.1-0ubuntu3.122.14.1-0ubuntu3.132.14.1-0ubuntu3.152.14.1-0ubuntu3.162.14.1-0ubuntu3.182.14.1-0ubuntu3.192.14.1-0ubuntu3.202.14.1-0ubuntu3.212.14.1-0ubuntu3.232.14.1-0ubuntu3.242.14.1-0ubuntu3.252.14.1-0ubuntu3.272.14.1-0ubuntu3.282.14.1-0ubuntu3.292.14.1-0ubuntu3.29+esm12.14.1-0ubuntu3.29+esm22.14.1-0ubuntu3.29+esm32.14.1-0ubuntu3.29+esm42.14.1-0ubuntu3.29+esm52.14.1-0ubuntu3.29+esm6
2.14.1-0ubuntu3.29+esm7
apport
Ubuntu:Pro:16.04:LTS
 before 2.20.1-0ubuntu2.30+esm1, plus listed versions
2.19.1-0ubuntu32.19.2-0ubuntu12.19.2-0ubuntu22.19.2-0ubuntu32.19.2-0ubuntu4
Show 38 moreShow less
2.19.2-0ubuntu52.19.2-0ubuntu62.19.2-0ubuntu82.19.2-0ubuntu92.19.3-0ubuntu12.19.3-0ubuntu22.19.3-0ubuntu32.19.4-0ubuntu12.19.4-0ubuntu22.20-0ubuntu22.20-0ubuntu32.20.1-0ubuntu12.20.1-0ubuntu22.20.1-0ubuntu2.12.20.1-0ubuntu2.22.20.1-0ubuntu2.42.20.1-0ubuntu2.52.20.1-0ubuntu2.62.20.1-0ubuntu2.92.20.1-0ubuntu2.102.20.1-0ubuntu2.122.20.1-0ubuntu2.132.20.1-0ubuntu2.142.20.1-0ubuntu2.152.20.1-0ubuntu2.162.20.1-0ubuntu2.172.20.1-0ubuntu2.182.20.1-0ubuntu2.192.20.1-0ubuntu2.202.20.1-0ubuntu2.212.20.1-0ubuntu2.222.20.1-0ubuntu2.232.20.1-0ubuntu2.242.20.1-0ubuntu2.252.20.1-0ubuntu2.262.20.1-0ubuntu2.272.20.1-0ubuntu2.282.20.1-0ubuntu2.30
2.20.1-0ubuntu2.30+esm1
apport
Ubuntu:18.04:LTS
 before 2.20.9-0ubuntu7.24, plus listed versions
2.20.7-0ubuntu32.20.7-0ubuntu3.12.20.7-0ubuntu42.20.8-0ubuntu12.20.8-0ubuntu2
Show 35 moreShow less
2.20.8-0ubuntu32.20.8-0ubuntu42.20.8-0ubuntu52.20.8-0ubuntu62.20.8-0ubuntu72.20.8-0ubuntu82.20.8-0ubuntu92.20.8-0ubuntu102.20.9-0ubuntu12.20.9-0ubuntu22.20.9-0ubuntu42.20.9-0ubuntu52.20.9-0ubuntu62.20.9-0ubuntu72.20.9-0ubuntu7.12.20.9-0ubuntu7.22.20.9-0ubuntu7.32.20.9-0ubuntu7.42.20.9-0ubuntu7.52.20.9-0ubuntu7.62.20.9-0ubuntu7.72.20.9-0ubuntu7.82.20.9-0ubuntu7.92.20.9-0ubuntu7.112.20.9-0ubuntu7.122.20.9-0ubuntu7.132.20.9-0ubuntu7.142.20.9-0ubuntu7.152.20.9-0ubuntu7.162.20.9-0ubuntu7.172.20.9-0ubuntu7.182.20.9-0ubuntu7.192.20.9-0ubuntu7.202.20.9-0ubuntu7.212.20.9-0ubuntu7.23
2.20.9-0ubuntu7.24
apport
Ubuntu:20.04:LTS
 before 2.20.11-0ubuntu27.18, plus listed versions
2.20.11-0ubuntu82.20.11-0ubuntu92.20.11-0ubuntu132.20.11-0ubuntu142.20.11-0ubuntu15
Show 24 moreShow less
2.20.11-0ubuntu162.20.11-0ubuntu172.20.11-0ubuntu182.20.11-0ubuntu192.20.11-0ubuntu202.20.11-0ubuntu212.20.11-0ubuntu222.20.11-0ubuntu242.20.11-0ubuntu252.20.11-0ubuntu262.20.11-0ubuntu272.20.11-0ubuntu27.22.20.11-0ubuntu27.32.20.11-0ubuntu27.42.20.11-0ubuntu27.62.20.11-0ubuntu27.82.20.11-0ubuntu27.92.20.11-0ubuntu27.102.20.11-0ubuntu27.112.20.11-0ubuntu27.122.20.11-0ubuntu27.132.20.11-0ubuntu27.142.20.11-0ubuntu27.162.20.11-0ubuntu27.17
2.20.11-0ubuntu27.18
apport
Ubuntu:18.04:LTS
From an advisory covering 11 CVEs
 before 2.20.9-0ubuntu7.24, plus listed versions
2.20.7-0ubuntu32.20.7-0ubuntu3.12.20.7-0ubuntu42.20.8-0ubuntu12.20.8-0ubuntu2
Show 35 moreShow less
2.20.8-0ubuntu32.20.8-0ubuntu42.20.8-0ubuntu52.20.8-0ubuntu62.20.8-0ubuntu72.20.8-0ubuntu82.20.8-0ubuntu92.20.8-0ubuntu102.20.9-0ubuntu12.20.9-0ubuntu22.20.9-0ubuntu42.20.9-0ubuntu52.20.9-0ubuntu62.20.9-0ubuntu72.20.9-0ubuntu7.12.20.9-0ubuntu7.22.20.9-0ubuntu7.32.20.9-0ubuntu7.42.20.9-0ubuntu7.52.20.9-0ubuntu7.62.20.9-0ubuntu7.72.20.9-0ubuntu7.82.20.9-0ubuntu7.92.20.9-0ubuntu7.112.20.9-0ubuntu7.122.20.9-0ubuntu7.132.20.9-0ubuntu7.142.20.9-0ubuntu7.152.20.9-0ubuntu7.162.20.9-0ubuntu7.172.20.9-0ubuntu7.182.20.9-0ubuntu7.192.20.9-0ubuntu7.202.20.9-0ubuntu7.212.20.9-0ubuntu7.23
2.20.9-0ubuntu7.24
apport
Ubuntu:20.04:LTS
From an advisory covering 11 CVEs
 before 2.20.11-0ubuntu27.18, plus listed versions
2.20.11-0ubuntu82.20.11-0ubuntu92.20.11-0ubuntu132.20.11-0ubuntu142.20.11-0ubuntu15
Show 24 moreShow less
2.20.11-0ubuntu162.20.11-0ubuntu172.20.11-0ubuntu182.20.11-0ubuntu192.20.11-0ubuntu202.20.11-0ubuntu212.20.11-0ubuntu222.20.11-0ubuntu242.20.11-0ubuntu252.20.11-0ubuntu262.20.11-0ubuntu272.20.11-0ubuntu27.22.20.11-0ubuntu27.32.20.11-0ubuntu27.42.20.11-0ubuntu27.62.20.11-0ubuntu27.82.20.11-0ubuntu27.92.20.11-0ubuntu27.102.20.11-0ubuntu27.112.20.11-0ubuntu27.122.20.11-0ubuntu27.132.20.11-0ubuntu27.142.20.11-0ubuntu27.162.20.11-0ubuntu27.17
2.20.11-0ubuntu27.18
apport
Ubuntu:Pro:14.04:LTS
From an advisory covering 11 CVEs
 before 2.14.1-0ubuntu3.29+esm7, plus listed versions
2.12.5-0ubuntu22.12.6-0ubuntu12.12.7-0ubuntu12.12.7-0ubuntu22.12.7-0ubuntu3
Show 43 moreShow less
2.12.7-0ubuntu62.13.1-0ubuntu12.13.1-0ubuntu22.13.2-0ubuntu22.13.2-0ubuntu32.13.2-0ubuntu42.13.2-0ubuntu52.13.3-0ubuntu12.14-0ubuntu12.14.1-0ubuntu12.14.1-0ubuntu22.14.1-0ubuntu32.14.1-0ubuntu3.12.14.1-0ubuntu3.22.14.1-0ubuntu3.32.14.1-0ubuntu3.42.14.1-0ubuntu3.52.14.1-0ubuntu3.62.14.1-0ubuntu3.72.14.1-0ubuntu3.82.14.1-0ubuntu3.92.14.1-0ubuntu3.102.14.1-0ubuntu3.112.14.1-0ubuntu3.122.14.1-0ubuntu3.132.14.1-0ubuntu3.152.14.1-0ubuntu3.162.14.1-0ubuntu3.182.14.1-0ubuntu3.192.14.1-0ubuntu3.202.14.1-0ubuntu3.212.14.1-0ubuntu3.232.14.1-0ubuntu3.242.14.1-0ubuntu3.252.14.1-0ubuntu3.272.14.1-0ubuntu3.282.14.1-0ubuntu3.292.14.1-0ubuntu3.29+esm12.14.1-0ubuntu3.29+esm22.14.1-0ubuntu3.29+esm32.14.1-0ubuntu3.29+esm42.14.1-0ubuntu3.29+esm52.14.1-0ubuntu3.29+esm6
2.14.1-0ubuntu3.29+esm7
apport
Ubuntu:Pro:16.04:LTS
From an advisory covering 11 CVEs
 before 2.20.1-0ubuntu2.30+esm1, plus listed versions
2.19.1-0ubuntu32.19.2-0ubuntu12.19.2-0ubuntu22.19.2-0ubuntu32.19.2-0ubuntu4
Show 38 moreShow less
2.19.2-0ubuntu52.19.2-0ubuntu62.19.2-0ubuntu82.19.2-0ubuntu92.19.3-0ubuntu12.19.3-0ubuntu22.19.3-0ubuntu32.19.4-0ubuntu12.19.4-0ubuntu22.20-0ubuntu22.20-0ubuntu32.20.1-0ubuntu12.20.1-0ubuntu22.20.1-0ubuntu2.12.20.1-0ubuntu2.22.20.1-0ubuntu2.42.20.1-0ubuntu2.52.20.1-0ubuntu2.62.20.1-0ubuntu2.92.20.1-0ubuntu2.102.20.1-0ubuntu2.122.20.1-0ubuntu2.132.20.1-0ubuntu2.142.20.1-0ubuntu2.152.20.1-0ubuntu2.162.20.1-0ubuntu2.172.20.1-0ubuntu2.182.20.1-0ubuntu2.192.20.1-0ubuntu2.202.20.1-0ubuntu2.212.20.1-0ubuntu2.222.20.1-0ubuntu2.232.20.1-0ubuntu2.242.20.1-0ubuntu2.252.20.1-0ubuntu2.262.20.1-0ubuntu2.272.20.1-0ubuntu2.282.20.1-0ubuntu2.30
2.20.1-0ubuntu2.30+esm1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-32554 is a high vulnerability (CVSS 7.3) in Canonical Apport, published May 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in apport 2.14.1-0ubuntu3.29+esm7.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open