Red Hat Security AdvisoryRHSA-2015:1083
abrt security update
Released 2015-06-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) abrt-2.1.11-22.el7_1, abrt-addon-ccpp-2.1.11-22.el7_1, abrt-addon-kerneloops-2.1.11-22.el7_1 +27
- Red Hat Enterprise Linux Client Optional (v. 7) abrt-addon-upload-watch-2.1.11-22.el7_1, abrt-devel-2.1.11-22.el7_1, abrt-gui-devel-2.1.11-22.el7_1 +10
- Red Hat Enterprise Linux ComputeNode (v. 7) abrt-2.1.11-22.el7_1, abrt-addon-ccpp-2.1.11-22.el7_1, abrt-addon-kerneloops-2.1.11-22.el7_1 +23
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) abrt-addon-upload-watch-2.1.11-22.el7_1, abrt-dbus-2.1.11-22.el7_1, abrt-desktop-2.1.11-22.el7_1 +14
- Red Hat Enterprise Linux Server (v. 7) abrt-2.1.11-22.ael7b_1, abrt-2.1.11-22.el7_1, abrt-addon-ccpp-2.1.11-22.ael7b_1 +47
- Red Hat Enterprise Linux Server Optional (v. 7) abrt-addon-upload-watch-2.1.11-22.ael7b_1, abrt-addon-upload-watch-2.1.11-22.el7_1, abrt-devel-2.1.11-22.ael7b_1 +28
- Red Hat Enterprise Linux Workstation (v. 7) abrt-2.1.11-22.el7_1, abrt-addon-ccpp-2.1.11-22.el7_1, abrt-addon-kerneloops-2.1.11-22.el7_1 +27
- Red Hat Enterprise Linux Workstation Optional (v. 7) abrt-addon-upload-watch-2.1.11-22.el7_1, abrt-devel-2.1.11-22.el7_1, abrt-gui-devel-2.1.11-22.el7_1 +10
Fixes 8 records
Priority MEDIUM 42
Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt/*/maps, (2) /tmp/jvm-*/hs_error.log,…
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.04776 · Published 2017-06-26 · Fixed CWE-59
Priority LOW 35
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInf…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0056 · Published 2020-01-14 · Fixed in 7a47f57975be0d285a2f20758e4572dca6d9cdd3 CWE-22
Priority LOW 34
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users…
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00388 · Published 2020-01-14 · Fixed in 9a4100678fea4d60ec93d35f4c5de2e9ad054f3a
Priority LOW 34
The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00411 · Published 2020-01-14 · Fixed in 7417505e1d93cc95ec648b74e3c801bc67aacb9f CWE-59
Priority LOW 31
abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProb…
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00398 · Published 2020-01-14 · Fixed in 1951e7282043dfe1268d492aea056b554baedb75 CWE-20
Priority LOW 31
daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01066 · Published 2020-01-14 · Fixed in 2.6.0 CWE-59
Priority LOW 25
The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages…
CVSS 3.0MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00421 · Published 2017-06-26 · Fixed CWE-200
Priority LOW 22
The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by l…
CVSS 3.0MEDIUM 4.7· Local · Low privileges · No interaction · EPSS 0.00345 · Published 2017-06-26 · Fixed CWE-200
THREATIST.IORead the docs