Description
sysreport before 1.3.7 allows local users to obtain sensitive information via a symlink attack on a temporary directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | sysreport | 1.3.7.2-9 | RHSA-2005:598 |
Advisories 1
- RHSA-2005:598 Red Hat Security Advisory: sysreport security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 16381 third-party-advisory
- 18682 vdb-entry
- 17539 third-party-advisory
- oval:org.mitre.oval:def:9411 vdb-entry signature
- FEDORA-2005-1071 vendor-advisory
- sysreport-race-condition(21770) vdb-entry
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=162978
- 1014653 vdb-entry
- 15379 vdb-entry
- RHSA-2005:598 vendor-advisory
- FEDORA-2005-1072 vendor-advisory