Red Hat Automatic Bug Reporting Tool vulnerabilities

18 CVEs affecting Red Hat Automatic Bug Reporting Tool, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-54231, published 2026-06-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability, published 2015-12-07. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-08-26. EPSS: 5% chance of exploitation in the next 30 days. The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable…
CVE-2015-3315, published 2017-06-26. High severity, CVSS 7.8. EPSS: 4.8% chance of exploitation in the next 30 days. Automatic Bug Reporting Tool (ABRT) allows local users to read, change the ownership of, or have other unspecified impact on arbitrary files via a symlink attack on (1) /var/tmp/abrt/*/maps, (2)…
CVE-2015-1862, published 2018-02-09. High severity, CVSS 7.0. EPSS: 3% chance of exploitation in the next 30 days. The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
CVE-2011-4088, published 2020-01-31. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. ABRT might allow attackers to obtain sensitive information from crash reports.
CVE-2015-3147, published 2020-01-14. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other…
CVE-2015-5273, published 2015-12-07. Low severity, CVSS 3.6. EPSS: 0.9% chance of exploitation in the next 30 days. The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio…
CVE-2015-3151, published 2020-01-14. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1)…
CVE-2012-5659, published 2013-03-12. Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days. Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to load and execute arbitrary…
CVE-2012-1106, published 2012-07-03. Low severity, CVSS 1.9. EPSS: 0.4% chance of exploitation in the next 30 days. The C handler plug-in in Automatic Bug Reporting Tool (ABRT), possibly 2.0.8 and earlier, does not properly set the group (GID) permissions on core dump files for setuid programs when the sysctl…
CVE-2015-1870, published 2017-06-26. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information…

Latest

CVE-2026-54231, published 2026-06-13. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and…
CVE-2026-54230, published 2026-06-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the…
CVE-2015-3159, published 2020-01-14. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo,…
CVE-2015-3150, published 2020-01-14. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2)…
CVE-2015-1869, published 2020-01-14. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
CVE-2013-4209, published 2018-05-01. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. Automatic Bug Reporting Tool (ABRT) before 2.1.6 allows local users to obtain sensitive information about arbitrary files via vectors related to sha1sums.