The C handler plug-in in Automatic Bug Reporting Tool (ABRT), possibly 2.0.8 and earlier, does not properly set the group (GID) permissions on core dump files for setuid programs when the sysctl fs.suid_dumpable option is set to 2, which allows local users to obtain sensitive information.
CVSS Details
- CVSS 3.1 Base Score: 3.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libreport-newtUpgrade abrt-addon-vmcoreUpgrade abrt-addon-kerneloopsUpgrade libreport-develUpgrade libreport-plugin-reportuploaderUpgrade abrt-cliUpgrade libreport-plugin-loggerUpgrade abrtUpgrade libreport-pythonUpgrade abrt-addon-pythonUpgrade libreport-plugin-bugzillaUpgrade libreport-plugin-kerneloopsUpgrade btparser-pythonUpgrade abrt-tuiUpgrade libreport-gtk-develUpgrade abrt-libsUpgrade abrt-addon-ccppUpgrade libreport-cliUpgrade abrt-desktopUpgrade btparser-develUpgrade libreport-gtkUpgrade libreport-plugin-rhtsupportUpgrade libreport-plugin-mailxUpgrade abrt-develUpgrade btparserUpgrade abrt-guiUpgrade libreport | Dec 1, 2016 | Jul 3, 2012 |
| Oracle_linux | — | Upgrade btparser-pythonUpgrade libreport-plugin-reportuploaderUpgrade libreport-gtkUpgrade abrt-develUpgrade libreport-newtUpgrade abrt-guiUpgrade libreport-cliUpgrade abrt-addon-vmcoreUpgrade abrt-desktopUpgrade abrt-addon-ccppUpgrade abrt-cliUpgrade abrt-addon-pythonUpgrade btparser-develUpgrade btparserUpgrade libreport-plugin-mailxUpgrade libreportUpgrade python-mehUpgrade abrt-libsUpgrade abrt-tuiUpgrade libreport-pythonUpgrade libreport-develUpgrade abrtUpgrade libreport-gtk-develUpgrade libreport-plugin-bugzillaUpgrade libreport-plugin-kerneloopsUpgrade libreport-plugin-loggerUpgrade abrt-addon-kerneloops | Oct 16, 2024 | Jul 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub