Name: CVE-2015-3142: Exposure of Sensitive Information to an Unauthorized Actor
Creator: Rapid7
Published: 2017-06-26T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2015-3142, CWE-200, CVSS 4.7, EPSS 0.00345

The kernel-invoked coredump processor in Automatic Bug Reporting Tool (ABRT) does not properly check the ownership of files before writing core dumps to them, which allows local users to obtain sensitive information by leveraging write permissions to the working directory of a crashed application.

CVSS Details

CVSS 3.0 Base Score: 4.7
CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade abrt-addon-pstoreoopsUpgrade libreport-centosUpgrade libreport-gtk-develUpgrade abrt-guiUpgrade libreport-rhel-anaconda-bugzillaUpgrade libreport-gtkUpgrade abrt-pythonUpgrade abrt-console-notificationUpgrade abrt-python-docUpgrade abrt-tuiUpgrade abrt-gui-develUpgrade abrt-addon-xorgUpgrade abrt-addon-vmcoreUpgrade abrt-libsUpgrade libreport-cliUpgrade libreport-webUpgrade libreport-rhelUpgrade abrt-gui-libsUpgrade libreport-web-develUpgrade abrt-retrace-clientUpgrade libreport-filesystemUpgrade libreport-plugin-loggerUpgrade libreport-compatUpgrade abrt-addon-ccppUpgrade libreport-pythonUpgrade libreport-plugin-reportuploaderUpgrade libreport-plugin-ureportUpgrade libreport-plugin-mantisbtUpgrade libreport-rhel-bugzillaUpgrade libreport-plugin-kerneloopsUpgrade libreport-develUpgrade abrt-dbusUpgrade libreportUpgrade abrtUpgrade abrt-addon-upload-watchUpgrade abrt-desktopUpgrade libreport-plugin-mailxUpgrade abrt-addon-pythonUpgrade abrt-develUpgrade libreport-newtUpgrade abrt-cliUpgrade libreport-anacondaUpgrade abrt-addon-kerneloopsUpgrade libreport-plugin-bugzillaUpgrade libreport-plugin-rhtsupport	Aug 17, 2018	Jun 15, 2015
Oracle_linux	—	Upgrade libreport-web-develUpgrade libreport-rhel-anaconda-bugzillaUpgrade libreport-compatUpgrade libreport-plugin-kerneloopsUpgrade abrt-addon-pythonUpgrade libreport-anacondaUpgrade libreport-plugin-bugzillaUpgrade libreport-plugin-mailxUpgrade abrt-gui-libsUpgrade libreport-plugin-reportuploaderUpgrade libreport-newtUpgrade libreport-develUpgrade abrt-addon-upload-watchUpgrade libreport-plugin-ureportUpgrade abrtUpgrade abrt-dbusUpgrade libreport-rhel-bugzillaUpgrade abrt-cliUpgrade abrt-retrace-clientUpgrade abrt-addon-kerneloopsUpgrade libreport-pythonUpgrade libreport-filesystemUpgrade abrt-develUpgrade libreport-cliUpgrade libreport-gtk-develUpgrade abrt-console-notificationUpgrade abrt-pythonUpgrade abrt-gui-develUpgrade abrt-python-docUpgrade abrt-addon-xorgUpgrade abrt-addon-ccppUpgrade libreport-plugin-loggerUpgrade abrt-tuiUpgrade libreport-gtkUpgrade abrt-addon-pstoreoopsUpgrade abrt-addon-vmcoreUpgrade abrt-desktopUpgrade libreportUpgrade abrt-libsUpgrade abrt-guiUpgrade libreport-web	Oct 16, 2024	Jun 26, 2017

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence