---
cve: "CVE-2016-9950"
severity: "LOW"
cvss: 3.1
epss: "6.6%"
vendor: "n/a"
kev: false
exploited: false
published: "2016-12-17 03:59:00"
tags: [cve, security, low]
source: tsecurity.de CVE-Dossier
exported: "2026-09-18T22:12:23+02:00"
---

# CVE-2016-9950

> 3.1 LOW · 🧪 PoC

## Beschreibung

An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this path traversal to execute arbitrary Python files from the local system.

## Exploit-Evidenz

- [EDB-40937 — Apport 2.x (Ubuntu Desktop 12.10 < 16.04) - Local Code Execution](https://www.exploit-db.com/exploits/40937)

## Referenzen

- <https://github.com/DonnchaC/ubuntu-apport-exploitation>
- <https://donncha.is/2016/12/compromising-ubuntu-desktop/>
- <https://bugs.launchpad.net/apport/+bug/1648806>
- <http://www.securityfocus.com/bid/95011>
- <http://www.ubuntu.com/usn/USN-3157-1>
- <https://www.exploit-db.com/exploits/40937/>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2016-9950) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_