The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
High 7.8Actively exploitedPatch available
CVE-2015-5287
Red Hat Automatic Bug Reporting Tool — Privilege Escalation.
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated…
WeaknessCWE-59
Published Updated Source NVD and CISA KEV
CVSS 3.1
7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
5.0%
Higher than 92% of all CVEs (EPSS)
Status
Actively exploited
On CISA KEV since 26 Aug 2026
Patch
Available
See the vendor advisory
What happened
What to do
- 01Check whether you run Red Hat Automatic Bug Reporting Tool, and which version.
- 02Install the fixed version listed in the vendor advisory.
- 03Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA deadlineUS federal agencies must remediate by
References
- NVDnvd.nist.gov
- CISA KEVcisa.gov
- Vendor advisoryrhn.redhat.com
- Vendor advisoryrhn.redhat.com
- Patchgithub.com
- Third-party advisorypacketstormsecurity.com
- Third-party advisoryoracle.com
- Third-party advisorysecurityfocus.com
- Third-party advisorypacketstormsecurity.com
- Exploitopenwall.com
- Exploitbugzilla.redhat.com
- Mailing listexploit-db.com
Timeline · UTC
- Published to NVD
- Added to CISA KEV
- NVD record updated
- CISA remediation deadline
Also actively exploited
Other CVEs from Red Hat
9 more CVEs, 1 actively exploited
7.4Red Hat Libuser — Race Condition.ExploitedEPSS 8.5%9.1Red Hat OpenShift AI (RHOAI) — authorization bypass.EPSS 0.2%9.9Red Hat StreamsHub Console for Apache Kafka® — privilege escalation.EPSS 0.3%9.1Red Hat Red Hat build of Quarkus 3.27.6.redhat — This vulnerability allows unauthenticated attackers to bypass security controls on generated…EPSS 0.4%9.3Red Hat Build of Podman Desktop — path traversal.EPSS 0.2%9.0Red Hat Red Hat Directory Server 11 — The server does not discard plaintext bytes already buffered from a client connection when…EPSS 0.4%