Apport Settings Vulnerable to 'Billion Laughs' Attack

CVE-2022-28652

What is CVE-2022-28652?

The vulnerability in the parsing of the ~/.config/apport/settings file exposes systems to a 'billion laughs' attack, a type of denial-of-service (DoS) exploit that leverages XML's ability to create infinitely expanding data structures. This flaw can potentially disrupt application functionality and degrade system performance, presenting a significant risk to users who rely on Ubuntu's Apport for bug reporting and error handling.

References