Description
abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on "the directories used to store information about crashes."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | abrt +10 | 2.0.8-6.el6_3.2 | RHSA-2013:0215 |
| RHEL 6 | libreport +12 | 2.0.9-5.el6_3.2 | RHSA-2013:0215 |
Advisories 1
- RHSA-2013:0215 Red Hat Security Advisory: abrt and libreport security update Red Hat Security Advisories (RHSA) · Jun 28, 2026