daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade abrt-develUpgrade abrt-gui-libsUpgrade libreport-plugin-ureportUpgrade abrt-pythonUpgrade abrt-addon-kerneloopsUpgrade libreport-filesystemUpgrade abrtUpgrade libreport-compatUpgrade libreport-plugin-kerneloopsUpgrade libreport-plugin-rhtsupportUpgrade libreport-webUpgrade libreport-plugin-bugzillaUpgrade libreport-plugin-mailxUpgrade libreport-anacondaUpgrade libreport-gtk-develUpgrade abrt-gui-develUpgrade abrt-addon-pstoreoopsUpgrade abrt-addon-xorgUpgrade abrt-python-docUpgrade libreportUpgrade abrt-addon-ccppUpgrade abrt-libsUpgrade abrt-desktopUpgrade abrt-addon-pythonUpgrade abrt-cliUpgrade libreport-web-develUpgrade libreport-pythonUpgrade abrt-dbusUpgrade libreport-rhel-bugzillaUpgrade abrt-tuiUpgrade abrt-retrace-clientUpgrade libreport-rhel-anaconda-bugzillaUpgrade libreport-centosUpgrade libreport-plugin-loggerUpgrade libreport-gtkUpgrade libreport-newtUpgrade abrt-guiUpgrade abrt-addon-upload-watchUpgrade libreport-rhelUpgrade libreport-plugin-reportuploaderUpgrade abrt-console-notificationUpgrade libreport-develUpgrade abrt-addon-vmcoreUpgrade libreport-plugin-mantisbtUpgrade libreport-cli | Aug 17, 2018 | Jun 15, 2015 |
| Oracle_linux | — | Upgrade abrt-python-docUpgrade abrt-pythonUpgrade abrt-addon-xorgUpgrade libreport-filesystemUpgrade libreportUpgrade libreport-plugin-loggerUpgrade libreport-plugin-mailxUpgrade abrt-dbusUpgrade libreport-plugin-bugzillaUpgrade abrt-gui-libsUpgrade abrt-tuiUpgrade abrtUpgrade abrt-addon-ccppUpgrade abrt-addon-pstoreoopsUpgrade abrt-develUpgrade libreport-anacondaUpgrade libreport-webUpgrade abrt-gui-develUpgrade abrt-cliUpgrade abrt-libsUpgrade libreport-compatUpgrade libreport-gtk-develUpgrade libreport-plugin-kerneloopsUpgrade abrt-desktopUpgrade libreport-pythonUpgrade abrt-retrace-clientUpgrade abrt-addon-pythonUpgrade abrt-guiUpgrade abrt-console-notificationUpgrade abrt-addon-vmcoreUpgrade libreport-develUpgrade libreport-newtUpgrade abrt-addon-upload-watchUpgrade libreport-rhel-anaconda-bugzillaUpgrade libreport-plugin-ureportUpgrade abrt-addon-kerneloopsUpgrade libreport-gtkUpgrade libreport-cliUpgrade libreport-plugin-reportuploaderUpgrade libreport-rhel-bugzillaUpgrade libreport-web-devel | Oct 16, 2024 | Jan 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub