{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2019-7307",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2019-7307",
    "idYear": 2019,
    "status": "PUBLISHED",
    "publishedAt": "2019-08-29T14:40:18.750Z",
    "updatedAt": "2024-09-16T23:56:02.156Z",
    "importedAt": "2026-10-24T01:56:12.831Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml",
      "summary": "Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file with a symlink to any other file on the system and so cause Apport to include the contents of this other file in the resulting crash report. The crash report could then be read by that user either by causing it to be uploaded and reported to Launchpad, or by leveraging some other vulnerability to read the resulting crash report, and so allow the user to read arbitrary files on the system.",
      "affected": [
        {
          "vendor": "Ubuntu",
          "product": "apport",
          "versions": [
            {
              "version": "before 2.14.1-0ubuntu3.29+esm1",
              "status": "affected"
            },
            {
              "version": "before 2.20.1-0ubuntu2.19",
              "status": "affected"
            },
            {
              "version": "before 2.20.9-0ubuntu7.7",
              "status": "affected"
            },
            {
              "version": "before 2.20.10-0ubuntu27.1",
              "status": "affected"
            },
            {
              "version": "before 2.20.11-0ubuntu5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  }
}