Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to load and execute arbitrary Python modules by modifying the PYTHONPATH environment variable to reference a malicious Python module.
CVSS Details
- CVSS 3.1 Base Score: 4.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libreport-gtk-develUpgrade abrt-addon-ccppUpgrade abrt-addon-vmcoreUpgrade libreport-gtkUpgrade abrt-tuiUpgrade libreport-plugin-kerneloopsUpgrade libreport-plugin-loggerUpgrade abrtUpgrade libreport-plugin-rhtsupportUpgrade abrt-cliUpgrade abrt-guiUpgrade libreport-plugin-bugzillaUpgrade libreport-pythonUpgrade abrt-addon-pythonUpgrade abrt-libsUpgrade libreport-plugin-reportuploaderUpgrade abrt-desktopUpgrade libreport-plugin-mailxUpgrade libreport-newtUpgrade libreport-cliUpgrade abrt-develUpgrade libreportUpgrade libreport-develUpgrade abrt-addon-kerneloops | Dec 1, 2016 | Mar 12, 2013 |
| Oracle_linux | — | Upgrade abrt-develUpgrade abrt-cliUpgrade libreport-plugin-kerneloopsUpgrade libreport-plugin-loggerUpgrade libreport-plugin-reportuploaderUpgrade abrt-libsUpgrade abrtUpgrade abrt-addon-vmcoreUpgrade libreport-pythonUpgrade libreport-plugin-mailxUpgrade libreport-develUpgrade abrt-guiUpgrade abrt-addon-pythonUpgrade libreport-newtUpgrade abrt-addon-ccppUpgrade libreport-gtkUpgrade abrt-addon-kerneloopsUpgrade libreport-cliUpgrade abrt-desktopUpgrade libreport-gtk-develUpgrade libreportUpgrade libreport-plugin-bugzillaUpgrade abrt-tui | Oct 16, 2024 | Mar 12, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub