CVE-2021-3709

6.5 MEDIUM

Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed...

Published: 2021-10-01 · Last updated: 2026-06-17

Severity and scoring

CVSS: 6.5 MEDIUM
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE: CWE-22, CWE-538

Affected products

Vendor	Product
canonical	apport

Description

Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3;

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3709
[Vendor advisory]https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1934308
[Other]https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3709
[Vendor advisory]https://ubuntu.com/security/notices/USN-5077-1
[Vendor advisory]https://ubuntu.com/security/notices/USN-5077-2
[Vendor advisory]https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1934308
[Other]https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3709
[Vendor advisory]https://ubuntu.com/security/notices/USN-5077-1
[Vendor advisory]https://ubuntu.com/security/notices/USN-5077-2

Related CVEs

Same vendor

CVE-2026-47337 — Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket ... (3.3 LOW)
CVE-2026-47336 — Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code (3.3 LOW)
CVE-2026-47335 — Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications (5.5 MEDIUM)
CVE-2026-47334 — Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code (5.5 MEDIUM)
CVE-2026-47333 — Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, l... (7.8 HIGH)

Same CWE

CVE-2026-48777 — FileBrowser Quantum is a free, self-hosted, web-based file manager
CVE-2026-8442 — The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 12.6.8 (8.1 HIGH)
CVE-2026-49766 — Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions (9.9 CRITICAL)
CVE-2026-49061 — Unauthenticated Arbitrary File Download in WPC Product Options for WooCommerce <= 3.2.1 versions (7.5 HIGH)
CVE-2026-40779 — Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions (7.7 HIGH)