Red Hat Automatic Bug Reporting Tool vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Red Hat Automatic Bug Reporting Tool: 3 record(s), with affected versions and fixes.
cpe:2.3:a:redhat:automatic_bug_reporting_tool

CVE-2026-54231 Medium · 5.5 CWE-74 Jun 13, 2026

Abrt: unsanitized systemd journal content written to dump directory files enables content injection

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without sanitizing embedded control characters. A local user can inject arbitrary content into the journal output by embedding newline characters in syslog messages, controlling the content that root writes to dump directory files.

CVE-2026-54230 High · 7.8 CWE-59 Jun 13, 2026

Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

CVE-2015-5287 High · 7.8 KEV Urgent · 75 Public exploit CWE-59 Dec 7, 2015

Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.