Description
abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProblem method.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ABRT | ABRT | before 1951e7282043dfe1268d492aea056b554baedb75 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | abrt +20 | 2.1.11-22.ael7b_1 | RHSA-2015:1083 |
| RHEL 7 | libreport +21 | 2.1.11-23.ael7b_1 | RHSA-2015:1083 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | abrt +20 | 2.1.11-22.0.1.el7_1 | ELSA-2015-1083 |
| Oracle Linux 7 | libreport +19 | 2.1.11-23.0.1.el7_1 | ELSA-2015-1083 |
Advisories 2
- RHSA-2015:1083 Red Hat Security Advisory: abrt security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- ELSA-2015-1083 Important: abrt security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 9, 2015
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1214457
- https://github.com/abrt/abrt/commit/6e811d78e2719988ae291181f5b133af32ce62d8
- https://github.com/abrt/abrt/commit/7814554e0827ece778ca88fd90832bd4d05520b1
- https://github.com/abrt/abrt/commit/b7f8bd20b7fb5b72f003ae3fa647c1d75f4218b7
- https://github.com/abrt/libreport/commit/1951e7282043dfe1268d492aea056b554baedb75