CVE-2015-5287
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Published Dec 7, 2015 · updated Aug 26, 2026 · Red Hat Automatic Bug Reporting Tool
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Timeline
Detection, updates, and resolution for this record.
Dec 7, 2015 · Catalog
Detected
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Aug 26, 2026 · CISA KEV
Known exploited
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Aug 26, 2026 · Catalog
Updated
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Sep 9, 2026 · CISA KEV
Remediation due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date Sep 9, 2026
Affected
- cpe oracle/linux7
- cpe redhat/automatic bug reporting toolversion unspecified
- cpe redhat/enterprise linux6.0
- cpe redhat/enterprise linux7.0
- cpe redhat/enterprise linux desktop7.0
- cpe redhat/enterprise linux hpc node7.0
- cpe redhat/enterprise linux server7.0
- cpe redhat/enterprise linux workstation7.0
- vendor Red Hat Automatic Bug Reporting Toolversion unspecified
Sources
- CISA KEVCVE-2015-5287
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
cisa.gov - CVE.orgCVE-2015-5287
Official CVE identifier
cve.org - FIRST EPSSCVE-2015-5287
30-day exploitation probability 5.0%
first.org - Exploit Database38832
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database47421
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_linux/local/abrt_sosreport_priv_esc
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2015-5287
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-ha
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com