CVEvulnerability
CVE-2015-3142
4.7 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2017-06-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 4.7 MEDIUM — CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 1.9 LOW — AV:L/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application.
Affected configurations
• redhat automatic bug reporting tool (<= 2.1.11)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://rhn.redhat.com/errata/RHSA-2015-1083.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1210.html rhn.redhat.com
- http://www.openwall.com/lists/oss-security/2015/04/17/5 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/75116 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1212818 Issue Tracking, Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1083.html Vendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1210.html rhn.redhat.com
- http://www.openwall.com/lists/oss-security/2015/04/17/5 Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/75116 Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1212818 Issue Tracking, Vendor Advisory