Search CVEs, research… / diras.sa
  • CISA KEV
  • EXPLOITED
  • PoC PUBLIC

CVE-2015-5287: local privilege escalation in Red Hat Automatic Bug Reporting Tool

A local account that can write to ABRT’s temporary or spool locations can exploit a symlink weakness in the abrt-hook-ccpp helper to elevate privileges on systems running Automatic Bug Reporting Tool; this is tracked as CVE-2015-5287. The issue affects ABRT releases prior to 2.7.1 and requires only local file creation or manipulation in the predictable paths the helper uses, not remote network access or interactive user deception.

Published Updated Source: CVE Program, NVD, CISA KEV, FIRST EPSS, Vendor advisory

CVSS 3.1
7.8HIGH
EPSS
0.04962
CWE
CWE-59
KEV DUE DATE
PATCH
Not yet

DIRAS TAKE

Urgent: CISA placed this issue on the KEV catalog with a mandated remediation schedule and working exploit code is public, so prioritize mitigation for exposed ABRT installs immediately.

What is CVE-2015-5287?

A local account that can write to ABRT’s temporary or spool locations can exploit a symlink weakness in the abrt-hook-ccpp helper to elevate privileges on systems running Automatic Bug Reporting Tool; this is tracked as CVE-2015-5287. The issue affects ABRT releases prior to 2.7.1 and requires only local file creation or manipulation in the predictable paths the helper uses, not remote network access or interactive user deception. The weakness is classified as CWE-59 (Link Following).

Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Which versions of Red Hat Automatic Bug Reporting Tool are affected?

BRANCHAFFECTEDFIXED

Is CVE-2015-5287 being exploited?

CISA added CVE-2015-5287 to the Known Exploited Vulnerabilities catalog on 2026-08-26, and US federal agencies were required to remediate by 2026-09-09; public exploit code for this vulnerability is available.

How to fix CVE-2015-5287

  1. Implement Red Hat’s guidance and any recommended mitigations for ABRT without delay.
  2. Prevent local accounts from creating or modifying files in ABRT’s predictable temporary and spool directories.
  3. Remove or limit unnecessary local privileges and accounts that can reach ABRT helper files.
  4. Isolate or discontinue ABRT on internet-facing or multi-tenant hosts until a vendor fix is applied and monitor logs for signs of exploitation.

Frequently asked questions

Is CVE-2015-5287 being actively exploited?

CISA added CVE-2015-5287 to the Known Exploited Vulnerabilities catalog on 2026-08-26 with a remediation due date of 2026-09-09, and public exploit code for the flaw is available.

Which Automatic Bug Reporting Tool versions are affected by CVE-2015-5287?

ABRT versions before 2.7.1 are reported as affected by CVE-2015-5287.

Is there a patch for CVE-2015-5287?

No vendor patch is listed in the provided facts; follow Red Hat guidance for mitigations or discontinue use if updates are unavailable.

Does CVE-2015-5287 require authentication?

The flaw requires a local user with the ability to create or alter files in ABRT’s predictable directories rather than remote authentication.

References