CVE-2015-3147 — abrt: does not validate contents of uploaded problem reports

Back Back to CVE browser

MEDIUM

abrt: does not validate contents of uploaded problem reports

Published Jan 14, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 1.07%

Description

daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.

Affected products

Vendor ABRT Product ABRT Default
n/a
- Version
  before 2.6.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ABRT

n/a

Version	Status	Constraints
before 2.6.0	affected	-

Red Hat Enterprise Linux 6

abrt-0:2.0.8-26.el6_6.1

Fixed · RHSA-2015:1210
Red Hat Enterprise Linux 6

libreport-0:2.0.9-21.el6_6.1

Fixed · RHSA-2015:1210
Red Hat Enterprise Linux 7

abrt-0:2.1.11-22.ael7b_1

Fixed · RHSA-2015:1083
Red Hat Enterprise Linux 7

libreport-0:2.1.11-23.ael7b_1

Fixed · RHSA-2015:1083

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	abrt-0:2.0.8-26.el6_6.1	Fixed	RHSA-2015:1210
Red Hat Enterprise Linux 6	libreport-0:2.0.9-21.el6_6.1	Fixed	RHSA-2015:1210
Red Hat Enterprise Linux 7	abrt-0:2.1.11-22.ael7b_1	Fixed	RHSA-2015:1083
Red Hat Enterprise Linux 7	libreport-0:2.1.11-23.ael7b_1	Fixed	RHSA-2015:1083

Remediation

No remediation recorded yet.

Metrics

1.07% 0.01066

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01066

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.07% (0.01066)	63.50th	v5 (v2026.06.15)
Jun 15, 2026	1.07% (0.01075)	60.48th	v5 (v2026.06.15)
Mar 17, 2025	0.53% (0.00535)	65.43th	v4 (v2025.03.14)
Dec 12, 2024	0.07% (0.00070)	32.72th	v3 (v2023.03.01)
Jun 13, 2024	0.07% (0.00070)	30.63th	v3 (v2023.03.01)
Mar 7, 2023	0.07% (0.00070)	28.61th	v3 (v2023.03.01)
Mar 6, 2023	0.95% (0.00950)	32.28th	v2 (v2022.01.01)
Feb 13, 2023	0.95% (0.00950)	31.86th	v2 (v2022.01.01)
Feb 3, 2023	1.10% (0.01104)	53.31th	v2 (v2022.01.01)
Sep 10, 2022	0.95% (0.00950)	30.63th	v2 (v2022.01.01)
Apr 1, 2022	0.95% (0.00950)	28.61th	v2 (v2022.01.01)
Feb 4, 2022	0.95% (0.00950)	13.46th	v2 (v2022.01.01)

Weaknesses (2)

CWE-283

CWE-59

References (8)

http://rhn.redhat.com/errata/RHSA-2015-1083.html
x_refsource_MISCThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/17/5
x_refsource_MISCMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2015-3147
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1212953
x_refsource_MISCIssue TrackingThird Party Advisory
https://github.com/abrt/abrt/commit/3746b7627218438ae7d781fc8b18a221454e9091
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/abrt/abrt/pull/955
x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-3147
https://www.cve.org/CVERecord?id=CVE-2015-3147

Link	Providers	Tags
http://rhn.redhat.com/errata/RHSA-2015-1083.html		x_refsource_MISCThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/04/17/5		x_refsource_MISCMailing ListThird Party Advisory
https://access.redhat.com/security/cve/CVE-2015-3147		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1212953		x_refsource_MISCIssue TrackingThird Party Advisory
https://github.com/abrt/abrt/commit/3746b7627218438ae7d781fc8b18a221454e9091		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/abrt/abrt/pull/955		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-3147
https://www.cve.org/CVERecord?id=CVE-2015-3147