The C handler plug-in in Automatic Bug Reporting Tool (ABRT), possibly 2.0.8 and earlier, does not properly set the group (GID) permissions on core dump files for setuid programs when the sysctl fs.suid_dumpable option is set to 2, which allows local users to obtain sensitive information.
CVSS Details
- CVSS 3.1 Base Score: 3.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libreport-plugin-rhtsupportUpgrade abrt-addon-ccppUpgrade btparserUpgrade libreportUpgrade libreport-cliUpgrade btparser-develUpgrade btparser-pythonUpgrade libreport-plugin-kerneloopsUpgrade abrt-desktopUpgrade abrt-libsUpgrade libreport-plugin-mailxUpgrade abrt-tuiUpgrade libreport-gtkUpgrade abrt-develUpgrade abrt-guiUpgrade libreport-gtk-develUpgrade libreport-develUpgrade libreport-plugin-loggerUpgrade libreport-plugin-bugzillaUpgrade libreport-pythonUpgrade abrt-addon-pythonUpgrade abrtUpgrade abrt-cliUpgrade abrt-addon-kerneloopsUpgrade abrt-addon-vmcoreUpgrade libreport-newtUpgrade libreport-plugin-reportuploader | Dec 1, 2016 | Jul 3, 2012 |
| Oracle_linux | — | Upgrade libreport-plugin-mailxUpgrade btparser-develUpgrade abrt-cliUpgrade libreport-develUpgrade abrt-desktopUpgrade abrt-tuiUpgrade abrt-libsUpgrade libreport-plugin-loggerUpgrade btparserUpgrade libreport-pythonUpgrade abrt-addon-ccppUpgrade abrt-addon-kerneloopsUpgrade libreport-plugin-bugzillaUpgrade abrt-addon-pythonUpgrade libreport-gtk-develUpgrade libreport-plugin-kerneloopsUpgrade libreportUpgrade abrtUpgrade python-mehUpgrade abrt-guiUpgrade btparser-pythonUpgrade libreport-cliUpgrade abrt-develUpgrade libreport-plugin-reportuploaderUpgrade abrt-addon-vmcoreUpgrade libreport-gtkUpgrade libreport-newt | Oct 16, 2024 | Jul 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub