CVE-2015-3142 The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensit...
MediumCVSS 4.7
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat automatic bug reporting tool | <= 2.1.11 | No fix listed |
References
- RHSA-2015:1083 vendor-advisory
- RHSA-2015:1210 vendor-advisory
- [oss-security] 20150417 Re: Problems in automatic crash analysis frameworks mailing-list third-party-advisory
- 75116 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking vendor-advisory