{"id":"CVE-2015-5287","kind":"vulnerability","aliases":["CVE-2015-5287"],"related":[],"title":"The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain…","description":"Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Red Hat's Automatic Bug Reporting Tool (ABRT) has a local privilege escalation flaw caused by a symlink attack on a file with a predictable name. A local user with certain permissions can use it to gain higher privileges, and CISA lists it as actively exploited.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-08-26T00:00:00+00:00","products":[{"name":"Red Hat Automatic Bug Reporting Tool","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"redhat automatic bug reporting tool","fixed":[],"affected":"<= 2.7.0","ecosystem":"vendor"},{"name":"oracle linux","fixed":[],"affected":"= 7","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux hpc node","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 7.0","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 7.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["abrt","exploited","infrastructure","linux","red-hat","self-hosted"],"not_affected_if":["abrt-not-installed","no-local-untrusted-users"],"how_to_check":"Check whether the abrt package is installed on Red Hat systems, for example with rpm -q abrt.","fix":"The sources say the product may be end-of-life and advise discontinuing use or moving to a supported version; uninstall or stop using ABRT where possible.","status":"open","published_at":"2015-12-07T18:59:02+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:49+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:31:49Z","model":"claude-haiku-5-5","output":{"fix":"The sources say the product may be end-of-life and advise discontinuing use or moving to a supported version; uninstall or stop using ABRT where possible.\nunknown for a specific patched version.","summary":"Red Hat's Automatic Bug Reporting Tool (ABRT) has a local privilege escalation flaw caused by a symlink attack on a file with a predictable name. A local user with certain permissions can use it to gain higher privileges, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["red-hat","linux","abrt","self-hosted"],"confidence":0.6,"analyst_note":"Find the affected and fixed ABRT package versions from the Red Hat advisory for CVE-2015-5287 and confirm which RHEL releases ship ABRT.","how_to_check":"Check whether the abrt package is installed on Red Hat systems, for example with rpm -q abrt.\nunknown for affected versions in the sources.","needs_analyst":true,"not_affected_if":["abrt-not-installed","no-local-untrusted-users"],"severity_if_unknown":"high"},"cost_usd":0.000421,"input_tokens":2301,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':199C,225C,256C '-2015':22A,25A '-5287':23A,26A '2.7.1':15A '26':198C,224C,255C 'abrt':3A,13A,63B,80B,125C 'abrt-hook-ccpp':2A 'accord':188C 'action':184C 'activ':117B 'adher':252C 'advis':172C 'allow':16A,133C 'and/or':164C,176C 'appli':185C 'applic':222C 'asset':246C 'attack':91B,145C 'automat':9A,76B,121C 'automatic':29A,34A 'base':203C 'bod':197C,223C,254C 'bug':10A,30A,35A,77B,122C 'caus':87B 'ccpp':5A 'certain':20A,103B,137C 'cisa':113B,182C,195C,212C 'cloud':228C 'complianc':193C 'contain':126C 'could':132C,157C 'cve':21A,24A 'desktop':49A 'discontinu':174C,231C 'end':160C,166C 'end-of-lif':159C 'end-of-servic':165C 'ensur':192C,251C 'enterprise':41A,44A,47A,51A,56A,60A 'eo':169C 'eol':163C 'escal':85B,129C 'evalu':244C 'exploit':64B,118B 'exposur':249C 'file':94B,148C 'flaw':86B 'follow':221C 'forens':214C 'gain':109B,140C 'guidanc':210C,226C 'guidelin':258C 'hat':28A,69B,74B,120C 'help':6A 'higher':110B 'hook':4A 'host':72B 'hpc':53A 'impact':154C 'infrastructur':65B 'instruct':191C 'internet':248C 'life':162C 'linux':39A,42A,45A,48A,52A,57A,61A,66B 'list':114B 'local':17A,83B,100B,134C 'mitig':186C,237C 'name':98B,152C 'node':54A 'note':209C,220C 'oracle':38A 'patch':257C 'permiss':104B,138C 'predict':97B,151C 'priorit':200C 'privileg':84B,111B,128C,141C 'product':155C,235C 'program':7A 'red':27A,68B,73B,119C 'red-hat':67B 'redhat':33A,40A,43A,46A,50A,55A,59A 'report':11A,78B,123C 'reporting':31A,36A 'requir':183C,216C 'respons':242C 'risk':205C 'secur':201C 'see':206C,217C 'self':71B 'self-host':70B 'server':58A 'servic':168C,229C 'stakehold':240C 'support':180C 'symlink':90B,144C 'tool':12A,32A,37A,79B,124C 'transit':177C 'triag':215C 'unavail':239C 'updat':202C 'url':207C,218C 'use':106B,175C,232C 'user':18A,101B,135C,170C 'vendor':190C 'version':181C 'via':142C 'vulner':130C 'workstation':62A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-12-07T18:59:02+00:00","kev":{"dateAdded":"2026-08-26","dueDate":"2026-09-09","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-5287","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-5287","severity":null,"published_at":"2026-08-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-5287","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5287","severity":null,"published_at":"2015-12-07T18:59:02+00:00","modified_at":"2026-08-27T04:16:38+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}