7.8

CVE-2015-5287: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability

CVSS: 7.8v3.1HighKEVAnalyzed
Published 07-12-2015Last modified 27-08-2026
Open JSON

Vulnerability summary

CVE-2015-5287 is a high (CVSS 7.8) Link Following vulnerability in Red Hat Automatic Bug Reporting Tool. It is known to be exploited: CISA lists it, first on 26-08-2026. EPSS estimates a 5.00% chance of exploitation in the next 30 days, higher than 92.1% of scored vulnerabilities. 6 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
5.00%
0%100%
Low · +0.04 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits6reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 1
RHSA-2015:2505

Timeline

  1. 07-12-2015
    PublishedVulnerability first disclosed.
  2. 26-08-2026
    Added to CISA KEVRed Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
  3. 27-08-2026
    Last modifiedVulnerability information updated.
  4. 09-09-2026
    CISA remediation dueApply mitigations per vendor instructions.

Description

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

5.00%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

+0.04 pp

From 4.96% on 19-09-2026

19-09-202619-10-2026
EPSS score
5.00%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
26-08-2026
Federal due date
09-09-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. nvd.nist.gov/vuln/detail/CVE-2015-5287

Public exploits

6 found
  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

  • exploit-databaselocallinuxVerified

    ABRT - sosreport Privilege Escalation (Metasploit)

    Maturity: weaponized

Show all 6 exploits
  • exploit-databaselocallinuxVerified

    RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation

    Maturity: weaponized

  • exploit-databaselocalmultipleVerified

    abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    ABRT sosreport Privilege Escalation

    exploit/linux/local/abrt_sosreport_priv_esc

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Redhat6 products
Oracle1 product

2 vendors · 7 products

References

10 links