Threats affecting pkg:github/apport

CVE-2026-84410 is a privilege escalation vulnerability in Canonical's apport before version 2.37.0. It allows an unprivileged local attacker to gain root privileges by exploiting the automatic crash report processing pipeline, which runs as root and executes the ldd command on attacker-controlled crash files in /var/crash. This leads to arbitrary code execution with root privileges.

CVE-2026-86692 is a path traversal vulnerability in Canonical's apport software before version 2.37.0. It allows an attacker who can supply a crafted crash report to cause unintended file creation or overwriting outside the intended extraction directory during processing with apport-unpack. The vulnerability arises because base64-encoded keys are not properly validated, enabling arbitrary file writes such as to .bashrc or .profile, potentially leading to persistence or code execution in the user's context.