A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade abrt-addon-pstoreoopsUpgrade abrt-plugin-sosreportUpgrade python3-abrt-addonUpgrade abrt-libsUpgrade abrt-tuiUpgrade abrt-addon-ccppUpgrade abrt-desktopUpgrade abrt-cli-ngUpgrade abrt-addon-vmcoreUpgrade abrt-addon-xorgUpgrade abrt-console-notificationUpgrade python3-abrt-docUpgrade abrt-gui-libsUpgrade abrt-dbusUpgrade python3-abrt-container-addonUpgrade abrt-guiUpgrade abrt-addon-coredump-helperUpgrade abrtUpgrade abrt-cliUpgrade abrt-addon-kerneloopsUpgrade abrt-plugin-machine-idUpgrade python3-abrt | Dec 11, 2025 | Dec 4, 2025 |
| Oracle_linux | — | Upgrade python3-abrtUpgrade abrt-dbusUpgrade abrt-addon-xorgUpgrade abrt-tuiUpgrade abrt-console-notificationUpgrade abrt-gui-libsUpgrade abrt-plugin-machine-idUpgrade abrt-addon-coredump-helperUpgrade abrt-addon-vmcoreUpgrade abrt-plugin-sosreportUpgrade python3-abrt-docUpgrade abrt-guiUpgrade abrt-addon-ccppUpgrade abrt-addon-pstoreoopsUpgrade abrt-cliUpgrade python3-abrt-addonUpgrade abrt-addon-kerneloopsUpgrade python3-abrt-container-addonUpgrade abrt-libsUpgrade abrt-desktopUpgrade abrt-cli-ngUpgrade abrt | Dec 8, 2025 | Dec 3, 2025 |
| Redhat_linux | — | Upgrade abrt-addon-xorg-debuginfoUpgrade abrt-tui-debuginfoUpgrade abrt-dbusUpgrade abrt-desktopUpgrade abrt-debuginfoUpgrade abrt-addon-kerneloopsUpgrade abrt-cliUpgrade abrt-addon-pstoreoopsUpgrade abrt-guiUpgrade abrt-plugin-machine-idUpgrade abrt-addon-ccppUpgrade python3-abrt-docUpgrade abrt-addon-ccpp-debuginfoUpgrade abrt-addon-upload-watch-debuginfoUpgrade python3-abrt-addonUpgrade python3-abrt-container-addonUpgrade abrt-gui-libsUpgrade abrtUpgrade abrt-libsUpgrade abrt-addon-coredump-helper-debuginfoUpgrade abrt-cli-ngUpgrade abrt-atomic-debuginfoUpgrade abrt-dbus-debuginfoUpgrade abrt-addon-xorgUpgrade abrt-addon-coredump-helperUpgrade abrt-retrace-client-debuginfoUpgrade abrt-plugin-sosreportUpgrade abrt-addon-kerneloops-debuginfoNo solution existsUpgrade abrt-console-notificationUpgrade abrt-tuiUpgrade python3-abrt-debuginfoUpgrade abrt-libs-debuginfoUpgrade abrt-addon-vmcoreUpgrade python3-abrtUpgrade abrt-gui-debuginfoUpgrade abrt-gui-libs-debuginfoUpgrade abrt-addon-pstoreoops-debuginfoUpgrade abrt-debugsource | Dec 5, 2025 | Dec 3, 2025 |
| Rocky_linux | — | Upgrade abrt-dbusUpgrade abrt-addon-ccppUpgrade abrt-addon-pstoreoopsUpgrade abrt-addon-xorgUpgrade abrt-libs-debuginfoUpgrade abrt-libsUpgrade abrt-gui-debuginfoUpgrade abrt-gui-libs-debuginfoUpgrade abrt-addon-kerneloops-debuginfoUpgrade python3-abrt-addonUpgrade abrt-tuiUpgrade abrt-addon-coredump-helper-debuginfoUpgrade abrt-addon-pstoreoops-debuginfoUpgrade abrt-addon-ccpp-debuginfoUpgrade abrt-cli-ngUpgrade abrt-debuginfoUpgrade abrt-desktopUpgrade abrt-tui-debuginfoUpgrade abrt-plugin-sosreportUpgrade abrt-dbus-debuginfoUpgrade abrt-addon-xorg-debuginfoUpgrade abrt-addon-vmcoreUpgrade abrt-addon-kerneloopsUpgrade abrt-addon-coredump-helperUpgrade abrt-plugin-machine-idUpgrade abrtUpgrade abrt-debugsourceUpgrade python3-abrt-debuginfoUpgrade abrt-guiUpgrade abrt-gui-libsUpgrade python3-abrtUpgrade python3-abrt-container-addonUpgrade abrt-cliUpgrade abrt-console-notification | May 25, 2026 | May 21, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub