Cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ooraclelinux7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 26 Aug 2026 20:17:10 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLocal Privilege Escalation in Red Hat Automatic Bug Reporting Toolhttps://feed.craftedsignal.io/briefs/2026-08-abrt-priv-esc/Wed, 26 Aug 2026 20:17:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-abrt-priv-esc/The Red Hat Automatic Bug Reporting Tool (ABRT) contains a local privilege escalation vulnerability (CVE-2015-5287) that allows unauthorized users to gain elevated access via symlink attacks.CVE-2015-5287 is a privilege escalation vulnerability within the Red Hat Automatic Bug Reporting Tool (ABRT), an open-source utility designed to collect and report diagnostic data. An attacker with local access can exploit improper file handling during the reporting process, specifically through a symlink attack targeting files with predictable names. By redirecting file operations to sensitive system files, a malicious local user may gain escalated privileges on the host system. This vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Given that ABRT is frequently installed on RHEL-based systems, security teams should assess current exposure, particularly on systems running older or end-of-life software versions, as indicated by CISA BOD 26-04.

Impact

Successful exploitation allows a local user to escalate privileges beyond their current authorization level, potentially leading to full system compromise. The impact is primarily restricted to systems where the ABRT service is active and local users have sufficient permissions to initiate reporting processes. Organizations still running affected, legacy versions of RHEL or related distributions are at the highest risk.

Recommendation

  • Transition away from end-of-life versions of the Red Hat Automatic Bug Reporting Tool as advised by the vendor and CISA.
  • Evaluate internet-facing assets for the presence of the vulnerable ABRT package and ensure patching or removal in accordance with CISA BOD 26-04.
  • Conduct a forensics triage of assets identified as running legacy or vulnerable versions of ABRT following CISA guidance.
]]>mediumadvisory