CVE-2015-3159: High severity red hat automatic bug reporting tool vulnerability
It was discovered that the helper program, abrt-action-install-debuginfo-to-abrt-cache, does not properly filter the process environment (umask and truncated command line options) before invoking abrt-action-install-debuginfo. A local user could exploit this vulnerability to obtain root privileges.
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security.
Other sources
The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2015-3159?
CVE-2015-3159 is a vulnerability in the Automatic Bug Reporting Tool (ABRT) which allows local users to gain privileges.
What is the severity of CVE-2015-3159?
CVE-2015-3159 has a severity rating of 7.8, which is considered high.
How does CVE-2015-3159 impact Redhat Automatic Bug Reporting Tool?
CVE-2015-3159 affects Redhat Automatic Bug Reporting Tool, allowing local users to gain privileges.
How can I fix CVE-2015-3159?
To fix CVE-2015-3159, it is recommended to update to the latest version of the Automatic Bug Reporting Tool (ABRT).
Where can I find more information about CVE-2015-3159?
You can find more information about CVE-2015-3159 in the references provided: [Bugzilla Red Hat](https://bugzilla.redhat.com/show_bug.cgi?id=1216975) and [GitHub ABRT Commits](https://github.com/abrt/abrt/commit/9943a77bca37a0829ccd3784d1dfab37f8c24e7b) (commit 9943a77) and [GitHub ABRT Commits](https://github.com/abrt/abrt/commit/9a4100678fea4d60ec93d35f4c5de2e9ad054f3a) (commit 9a41006).