Summary
[2.1.11-60.0.5]
- Fix TOCTOU in SetElement/DeleteElement (CVE-2026-54228) [Orabug: 39811882]
- Fix race condition in ChownProblemDir (CVE-2026-54229) [Orabug: 39811882]
Fixed packages 21
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | abrt | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-addon-ccpp | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-addon-kerneloops | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-addon-pstoreoops | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-addon-python | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-addon-upload-watch | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-addon-vmcore | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-addon-xorg | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-cli | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-console-notification | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-dbus | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-desktop | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-devel | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-gui | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-gui-devel | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-gui-libs | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-libs | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-python | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-python-doc | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-retrace-client | 0:2.1.11-60.0.5.el7 |
| Oracle Linux · 7 | abrt-tui | 0:2.1.11-60.0.5.el7 |
Vulnerabilities 2
-
High 7.8
Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-o…
-
High 7.0
Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event…