CVE-2015-5273: redhat automatic_bug_reporting_tool Link Following

Vulnerability summary

CVE-2015-5273 is a low (CVSS 3.6) Link Following vulnerability in redhat automatic_bug_reporting_tool. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 59% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 07-12-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write to arbitrary files via a symlink attack on unpacked.cpio in a pre-created directory with a predictable name in /var/tmp.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.