A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade abrt-gui-libsUpgrade abrt-addon-kerneloopsUpgrade abrt-addon-pstoreoopsUpgrade abrtUpgrade abrt-cliUpgrade abrt-addon-coredump-helperUpgrade python3-abrt-docUpgrade python3-abrt-container-addonUpgrade python3-abrtUpgrade abrt-plugin-machine-idUpgrade abrt-console-notificationUpgrade abrt-desktopUpgrade abrt-libsUpgrade abrt-addon-vmcoreUpgrade abrt-dbusUpgrade abrt-tuiUpgrade abrt-addon-ccppUpgrade python3-abrt-addonUpgrade abrt-plugin-sosreportUpgrade abrt-guiUpgrade abrt-cli-ngUpgrade abrt-addon-xorg | Oct 11, 2026 | Aug 12, 2026 |
| Redhat_linux | — | Upgrade python3-abrt-docUpgrade abrt-plugin-machine-idUpgrade abrt-addon-upload-watchUpgrade abrt-addon-xorg-debuginfoUpgrade abrt-atomic-debuginfoUpgrade abrt-guiUpgrade abrt-libs-debuginfoUpgrade abrt-addon-pythonUpgrade python3-abrtUpgrade abrt-debuginfoUpgrade abrt-addon-vmcoreUpgrade abrt-addon-coredump-helperUpgrade abrt-tui-debuginfoUpgrade abrt-retrace-clientUpgrade abrt-retrace-client-debuginfoUpgrade abrt-addon-upload-watch-debuginfoUpgrade abrt-console-notificationUpgrade abrt-develUpgrade abrt-addon-kerneloopsUpgrade abrt-debugsourceUpgrade abrt-libsUpgrade python3-abrt-container-addonUpgrade abrt-dbusUpgrade abrt-addon-ccppUpgrade abrt-addon-pstoreoops-debuginfoUpgrade abrtUpgrade python3-abrt-addonUpgrade abrt-addon-pstoreoopsUpgrade abrt-plugin-sosreportUpgrade python3-abrt-debuginfoUpgrade abrt-addon-ccpp-debuginfoUpgrade abrt-gui-libs-debuginfoUpgrade abrt-pythonUpgrade abrt-dbus-debuginfoUpgrade abrt-tuiUpgrade abrt-python-docUpgrade abrt-cliUpgrade abrt-addon-kerneloops-debuginfoNo solution existsUpgrade abrt-gui-develUpgrade abrt-gui-debuginfoUpgrade abrt-desktopUpgrade abrt-gui-libsUpgrade abrt-addon-coredump-helper-debuginfoUpgrade abrt-addon-xorgUpgrade abrt-cli-ng | Jul 17, 2026 | May 4, 2026 |
| Rocky_linux | — | Upgrade python3-abrtUpgrade abrt-dbusUpgrade abrt-console-notificationUpgrade abrt-addon-coredump-helper-debuginfoUpgrade abrt-tui-debuginfoUpgrade abrt-addon-ccppUpgrade python3-abrt-container-addonUpgrade abrt-libsUpgrade abrt-desktopUpgrade abrt-addon-kerneloopsUpgrade abrt-cli-ngUpgrade abrt-gui-debuginfoUpgrade abrt-addon-pstoreoopsUpgrade python3-abrt-addonUpgrade abrt-addon-ccpp-debuginfoUpgrade abrt-debuginfoUpgrade abrt-addon-xorg-debuginfoUpgrade abrt-tuiUpgrade abrt-gui-libsUpgrade abrt-addon-vmcoreUpgrade abrt-addon-pstoreoops-debuginfoUpgrade abrt-guiUpgrade abrt-cliUpgrade abrtUpgrade abrt-addon-coredump-helperUpgrade python3-abrt-debuginfoUpgrade abrt-libs-debuginfoUpgrade abrt-addon-xorgUpgrade abrt-debugsourceUpgrade abrt-addon-kerneloops-debuginfoUpgrade abrt-plugin-machine-idUpgrade abrt-gui-libs-debuginfoUpgrade abrt-dbus-debuginfoUpgrade abrt-plugin-sosreport | Aug 14, 2026 | Aug 13, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub