Live › vulnerability › CVE-2015-5287
Go to dashboardRed Hat's Automatic Bug Reporting Tool (ABRT) has a local privilege escalation flaw caused by a symlink attack on a file with a predictable name. A local user with certain permissions can use it to gain higher privileges, and CISA lists it as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Red Hat Automatic Bug Reporting Tool | vendor | – | – |
| redhat automatic bug reporting tool | vendor | <= 2.7.0 | – |
| oracle linux | vendor | = 7 | – |
| redhat enterprise linux | vendor | = 6.0 | – |
| redhat enterprise linux |
| vendor |
| = 7.0 |
| – |
| redhat enterprise linux desktop | vendor | = 7.0 | – |
| redhat enterprise linux hpc node | vendor | = 7.0 | – |
| redhat enterprise linux server | vendor | = 7.0 | – |
| redhat enterprise linux workstation | vendor | = 7.0 | – |
Check whether the abrt package is installed on Red Hat systems, for example with rpm -q abrt.
The sources say the product may be end-of-life and advise discontinuing use or moving to a supported version; uninstall or stop using ABRT where possible.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2015-5287")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.