Fixed packages 38
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-ccpp | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-ccpp-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-coredump-helper | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-coredump-helper-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-kerneloops | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-kerneloops-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-pstoreoops | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-pstoreoops-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-upload-watch-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-vmcore | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-xorg | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-addon-xorg-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-atomic-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-cli | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-cli-ng | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-console-notification | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-dbus | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-dbus-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-debugsource | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-desktop | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-gui | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-gui-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-gui-libs | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-gui-libs-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-libs | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-libs-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-plugin-machine-id | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-plugin-sosreport | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-retrace-client-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-tui | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | abrt-tui-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | python3-abrt | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | python3-abrt-addon | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | python3-abrt-container-addon | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | python3-abrt-debuginfo | 0:2.10.9-26.el8_10 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | python3-abrt-doc | 0:2.10.9-26.el8_10 |
Vulnerabilities 4
-
High 7.8
Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories
A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Between dump directory creation and post-create event execution, any local user can call SetElement to write arbitrary text files into the root-o…
-
High 7.0
Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking
A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump directory with DD_OPEN_READONLY and calls dd_chown to change ownership of all files to the caller's uid, succeeding even while post-create event…
-
High 7.0
Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites
A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process run…
-
Medium 5.5
Abrt: unsanitized systemd journal content written to dump directory files enables content injection
A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script queries the systemd journal for log entries matching the crashed process and writes the results to files in the dump directory without san…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488531
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488532
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488568
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2488571
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54272.json
-
report
https://access.redhat.com/security/cve/CVE-2026-54228
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-54228
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-54228
-
report
https://access.redhat.com/security/cve/CVE-2026-54229
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-54229
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-54229
-
report
https://access.redhat.com/security/cve/CVE-2026-54230
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-54230
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-54230
-
report
https://access.redhat.com/security/cve/CVE-2026-54231
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-54231
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-54231