CVE-2016-9949

An issue was discovered in Apport before 2.20.4. In apport/ui.py, Apport reads the CrashDB field and it then evaluates the field as Python code if it begins with a "{". This allows remote attackers to execute arbitrary Python code.

• CWE-94

• http://www.securityfocus.com/bid/95011Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-3157-1
• https://bugs.launchpad.net/apport/+bug/1648806Issue Tracking, Patch
• https://donncha.is/2016/12/compromising-ubuntu-desktop/Exploit, Technical Description, Third Party Advisory
• https://github.com/DonnchaC/ubuntu-apport-exploitationIssue Tracking, Third Party Advisory
• https://www.exploit-db.com/exploits/40937/
• http://www.securityfocus.com/bid/95011Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-3157-1
• https://bugs.launchpad.net/apport/+bug/1648806Issue Tracking, Patch
• https://donncha.is/2016/12/compromising-ubuntu-desktop/Exploit, Technical Description, Third Party Advisory
• https://github.com/DonnchaC/ubuntu-apport-exploitationIssue Tracking, Third Party Advisory
• https://www.exploit-db.com/exploits/40937/

Published

Dec 17, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9936The unserialize implementation in ext/standard/var.c in PHP …
• CVE-2016-9937An issue was discovered in Asterisk Open Source 13.12.x and …
• CVE-2016-9938An issue was discovered in Asterisk Open Source 11.x before …
• CVE-2016-9939Crypto++ (aka cryptopp and libcrypto++) 5.6.4 contained a bu…
• CVE-2016-9941Heap-based buffer overflow in rfbproto.c in LibVNCClient in …
• CVE-2016-9942Heap-based buffer overflow in ultra.c in LibVNCClient in Lib…
• CVE-2016-9950An issue was discovered in Apport before 2.20.4. There is a …
• CVE-2016-9951An issue was discovered in Apport before 2.20.4. A malicious…
• CVE-2016-9952The verify_certificate function in lib/vtls/schannel.c in li…8.1
• CVE-2016-9953The verify_certificate function in lib/vtls/schannel.c in li…
• CVE-2016-9954The backtrack compilation code in the Irregex package (aka I…
• CVE-2016-9955The SimpleSAML_XML_Validator class constructor in SimpleSAML…