Medium severity · published Jun 26, 2017
CVE-2015-3142
The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local…
4.7
CVSS
0.3%
EPSS
No
On KEV
Description
The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Automatic Bug Reporting Tool · Redhat
through 2.1.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3142
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1083.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1210.html
Mailing List
http://www.openwall.com/lists/oss-security/2015/04/17/5
Third Party Advisory
http://www.securityfocus.com/bid/75116
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1212818
More from Automatic Bug Reporting Tool
7.8
CVE-2015-5287
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
7.8
CVE-2026-54230
Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites
7.8
CVE-2015-3159
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking…
7.8
CVE-2015-3151
Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified…
7.8
CVE-2015-1869
The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file