Description
Untrusted search path vulnerability in plugins/abrt-action-install-debuginfo-to-abrt-cache.c in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to load and execute arbitrary Python modules by modifying the PYTHONPATH environment variable to reference a malicious Python module.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | abrt +10 | 2.0.8-6.el6_3.2 | RHSA-2013:0215 |
| RHEL 6 | libreport +12 | 2.0.9-5.el6_3.2 | RHSA-2013:0215 |
Advisories 1
- RHSA-2013:0215 Red Hat Security Advisory: abrt and libreport security update Red Hat Security Advisories (RHSA) · Jun 28, 2026