ABRT vulnerabilities
5 known CVE vulnerabilities in ABRT, translated and rated.
- CVE-2015-5287HighActively exploited
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name.
- CVE-2026-54229High
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. It allows an attacker to gain filesystem-level control of the dump directory while privileged event scripts are still running.
- CVE-2026-54228High
A TOCTOU race condition was found in the SetElement method of the abrt-dbus D-Bus service. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-owned dump directory, bypassing package validation and allowing crashes of unpackaged binaries to survive.
- CVE-2011-4088High
ABRT might allow attackers to obtain sensitive information from crash reports.
- CVE-2015-1862High
The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.