CVE-2015-5287
published 2015-12-07CVE-2015-5287: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a…
PriorityP278high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2026-09-09
Exploited in the wild
EPSS
5.00%
92.2th percentile
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | linux | — | — |
| redhat | automatic_bug_reporting_tool | <= 2.7.0 | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vulncheck6.9MEDIUM
cisa7.8HIGH
vendor_redhat6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
cisa·2026-08-26·CVSS 7.8
CVE-2015-5287 [HIGH] Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Vulnerability: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
Affected: Red Hat Automatic Bug Reporting Tool
Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidan
Red Hat
abrt: incorrect permissions on /var/spool/abrt
vendor_redhat·2015-11-23·CVSS 6.9
CVE-2015-5287 [MEDIUM] abrt: incorrect permissions on /var/spool/abrt
abrt: incorrect permissions on /var/spool/abrt
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
It was discovered that the kernel-invoked coredump processor provided by ABRT did not handle symbolic links correctly when writing core dumps of ABRT programs to the ABRT dump directory (/var/spool/abrt). A local attacker with write access to an ABRT problem directory could use this flaw to escalate their privileges.
Package: abrt (Red Hat Enterprise Linux 6) - Not affected
VulDB
Automatic Bug Reporting Tool up to 2.7.0 abrt-hook-ccpp abrt-hax-coredump link following (RHSA-2015:2505 / EDB-38832)
vuldb·2026-08-26·CVSS 7.8
CVE-2015-5287 [HIGH] Automatic Bug Reporting Tool up to 2.7.0 abrt-hook-ccpp abrt-hax-coredump link following (RHSA-2015:2505 / EDB-38832)
A vulnerability described as problematic has been identified in Automatic Bug Reporting Tool up to 2.7.0. This vulnerability affects unknown code of the file /var/tmp/abrt/abrt-hax-coredump of the component abrt-hook-ccpp. The manipulation results in link following.
This vulnerability is cataloged as CVE-2015-5287. The attack must be initiated from a local position. Furthermore, there is an exploit available.
Upgrading the affected component is recommended.
GHSA
GHSA-hf8c-7p7w-mch5: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2
ghsa_unreviewed·2022-05-17
CVE-2015-5287 [MEDIUM] CWE-59 GHSA-hf8c-7p7w-mch5: The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
VulnCheck
Red Hat automatic_bug_reporting_tool Improper Link Resolution Before File Access ('Link Following')
vulncheck·2015·CVSS 6.9
CVE-2015-5287 [MEDIUM] Red Hat automatic_bug_reporting_tool Improper Link Resolution Before File Access ('Link Following')
Red Hat automatic_bug_reporting_tool Improper Link Resolution Before File Access ('Link Following')
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Affected: Red Hat automatic_bug_reporting_tool
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
No detection rules found.
Exploit-DB
ABRT - sosreport Privilege Escalation (Metasploit)
exploitdb·2019-09-25·CVSS 6.9
CVE-2015-5287 [MEDIUM] ABRT - sosreport Privilege Escalation (Metasploit)
ABRT - sosreport Privilege Escalation (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'ABRT sosreport Privilege Escalation',
'Description' => %q{
This module attempts to gain root privileges on RHEL systems with
a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured
as the crash handler.
`sosreport` uses an insecure temporary directory, allowing local users
to write to arbitrary files (CVE-2015-5287). This module uses a symlink
attack on `/var/tmp/abrt/cc-*$pid/` to overwrite the `modprobe` path
in `/proc/sys/kernel/modprobe`, resulting in root privileges.
Waiting for `sosreport` could take a few minutes.
This module has been tested success
Exploit-DB
RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
exploitdb·2015-12-01·CVSS 6.9
CVE-2015-5287 [MEDIUM] RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation
---
#!/usr/bin/python
# CVE-2015-5287 (?)
# abrt/sosreport RHEL 7.0/7.1 local root
# rebel 09/2015
# [user@localhost ~]$ python sosreport-rhel7.py
# crashing pid 19143
# waiting for dump directory
# dump directory: /var/tmp/abrt/ccpp-2015-11-30-19:41:13-19143
# waiting for sosreport directory
# sosreport: sosreport-localhost.localdomain-20151130194114
# waiting for tmpfiles
# tmpfiles: ['tmpurfpyY', 'tmpYnCfnQ']
# moving directory
# moving tmpfiles
# tmpurfpyY -> tmpurfpyY.old
# tmpYnCfnQ -> tmpYnCfnQ.old
# waiting for sosreport to finish (can take several minutes)........................................done
# success
# bash-4.2# id
# uid=0(root) gid=1000(user) groups=0(root),1000(user) context=unconfined_u:unconfined_r:unconfin
Exploit-DB
abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
exploitdb·2015-12-01·CVSS 3.6
CVE-2015-5287 [LOW] abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation
---
#!/usr/bin/python
# CVE-2015-5273 + CVE-2015-5287
# CENTOS 7.1/Fedora22 local root (probably works on SL and older versions too)
# abrt-hook-ccpp insecure open() usage + abrt-action-install-debuginfo insecure temp directory usage
# rebel 09/2015
# ----------------------------------------
# [user@localhost ~]$ id
# uid=1000(user) gid=1000(user) groups=1000(user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
# [user@localhost ~]$ cat /etc/redhat-release
# CentOS Linux release 7.1.1503 (Core)
# [user@localhost ~]$ python abrt-centos-fedora.py
# -- lots of boring output, might take a while on a slow connection --
# /var/spool/abrt/abrt-hax-coredump created
# executing crashing process..
# success
# bash-4.2# id
#
Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
exploitdb·2015-04-02·CVSS 8.8
CVE-2014-7910 [HIGH] Kemp Load Master 7.1.16 - Multiple Vulnerabilities
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
---
# Exploit Title: Kemp Load Master - Multiple Vulnerabilities (RCE, CSRF, XSS, DoS)
# Date: 01 April 2015
# Author: Roberto Suggi Liverani
# Software Link: http://kemptechnologies.com/load-balancer/
# Version: 7.1.16 and previous versions
# Tested on: Kemp Load Master 7.1-16
# CVE : CVE-2014-5287/5288
Link: http://blog.malerisch.net/2015/04/playing-with-kemp-load-master.html
Kemp virtual load master is a virtual load-balancer appliance which comes with a web administrative interface. I had a chance to test it and this blog post summarises some of the most interesting vulnerabilities I have discovered and which have not been published yet. For those of you who want to try it as well, you can get a free trial version here: http://kemp
Metasploit
ABRT sosreport Privilege Escalation
metasploit·CVSS 6.9
CVE-2015-5287 [MEDIUM] ABRT sosreport Privilege Escalation
ABRT sosreport Privilege Escalation
This module attempts to gain root privileges on RHEL systems with a vulnerable version of Automatic Bug Reporting Tool (ABRT) configured as the crash handler. `sosreport` uses an insecure temporary directory, allowing local users to write to arbitrary files (CVE-2015-5287). This module uses a symlink attack on `/var/tmp/abrt/cc-*$pid/` to overwrite the `modprobe` path in `/proc/sys/kernel/modprobe`, resulting in root privileges. Waiting for `sosreport` could take a few minutes. This module has been tested successfully on: abrt 2.1.11-12.el7 on RHEL 7.0 x86_64; and abrt 2.1.11-19.el7 on RHEL 7.1 x86_64.
Recorded Future
August 2026 CVE Landscape
blogs_recorded_future·2026-09-08·CVSS 8.8
CVE-2025-62593 [HIGH] August 2026 CVE Landscape
## August 2026 CVE Landscape
In August 2026, Insikt Group® identified 73 high-impact vulnerabilities that should be prioritized for remediation , 43 of which had a Very Critical Recorded Future Risk Score. This represents a 14% decrease from last month. 31 of these vulnerabilities were surfaced through the US Cybersecurity and Infrastructure Security Agency (CISA)’s Known Exploited Vulnerabilities (KEV) catalog, 32 were reported in open sources and validated by Insikt Group, seven were sourced through security vendor telemetry, and three were exclusively surfaced through honeypot data.
The 73 vulnerabilities in this blog affected products from 45 vendors, with Microsoft accounting for approximately 11% of the vulnerabilities. The remaining exposure spanned remote monitoring and managemen
Hackernews
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
blogs_hackernews·2026-08-27·CVSS 5.1
CVE-2019-1068 [MEDIUM] CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities ( KEV ) catalog, including a high-severity security vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway, citing evidence of active exploitation.
The vulnerabilities are listed below -
CVE-2019-1068 - A remote code execution vulnerability in Microsoft SQL Server that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
CVE-2026-8452 - An impr
Hackernews
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
blogs_hackernews·2026-08-24
CVE-2022-0995 UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors.
The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open directory hosted at "139.180.197[.]150," which was observed communicating with one of the compromised machines.
"The actor leveraged publicly d
Talos
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
blogs_talos·2026-08-20
CVE-2022-0995 UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
## UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos identified UAT-10147 targeting Windows and Linux web servers globally, impacting organizations in government, education, media, technology, and gaming sectors. The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale.
UAT-10147 integrated AI-driven tooling into exploitation, reconnaissance, payload generation, validation, and persistence workflows. Talos observed AI-generated operational playbooks, exploit automation scripts, and troubleshooting logic supporting real-world intrusions.
The actor employed a mixture of open-source offensive frameworks, including Metasploit, ysoserial, PentestGPT, DeepAudit, and multiple privilege escalation exploits to au
Bugzilla
CVE-2015-5287 abrt: incorrect permissions on /var/spool/abrt
bugzilla·2015-09-28·CVSS 6.9
CVE-2015-5287 [MEDIUM] CVE-2015-5287 abrt: incorrect permissions on /var/spool/abrt
CVE-2015-5287 abrt: incorrect permissions on /var/spool/abrt
A vulnerability allowing to elevate privileges from the abrt user to root was reported.
If a program starting with the name "abrt" crashes, abrt-hook-ccpp will write the coredump to /var/tmp/abrt/$filename-coredump or /var/spool/abrt/$filename-coredump. From abrt-hook-ccpp.c:
if (last_slash && strncmp(++last_slash, "abrt", 4) == 0)
{
/* If abrtd/abrt-foo crashes, we don't want to create a _directory_,
* since that can make new copy of abrtd to process it,
* and maybe crash again...
* Unlike dirs, mere files are ignored by abrtd.
*/
if (snprintf(path, sizeof(path), "%s/%s-coredump", g_settings_dump_location, last_slash) >= sizeof(path))
error_msg_and_die("Error saving '%s': truncated long file path", path);
int abrt_core_fd = x
Bugzilla
CVE-2015-5273 abrt: Insecure temporary directory usage in abrt-action-install-debuginfo-to-abrt-cache
bugzilla·2015-09-11·CVSS 3.6
CVE-2015-5273 [LOW] CVE-2015-5273 abrt: Insecure temporary directory usage in abrt-action-install-debuginfo-to-abrt-cache
CVE-2015-5273 abrt: Insecure temporary directory usage in abrt-action-install-debuginfo-to-abrt-cache
Multiple vulnerabilities were found in abrt allowing privilege escalation.
1. Insecure temporary directory and symlink usage in sosreport
A vulnerability allowing to elevate privileges from an unprivileged user to root on a default installation of RHEL 7/7.1 was reported.
When a process receives SIGSEGV, abrt will save diagnostic information in /var/tmp/abrt/ccpp-*$pid on RHEL 7. Unless /etc/abrt/abrt.conf contains the line "PrivateReports = yes", directories created here by abrt will be chown()'d to the user who owned the crashing process. After saving some initial information it will call post-create scripts, one of the default ones on RHEL is /usr/sbin/sosreport. /usr/sbin/sosrepor
http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2505.htmlhttp://www.openwall.com/lists/oss-security/2015/12/01/1http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/78137https://bugzilla.redhat.com/show_bug.cgi?id=1266837https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740ehttps://www.exploit-db.com/exploits/38832/http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2505.htmlhttp://www.openwall.com/lists/oss-security/2015/12/01/1http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/78137https://bugzilla.redhat.com/show_bug.cgi?id=1266837https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740ehttps://www.exploit-db.com/exploits/38832/https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287
2015-12-07
Published
2026-08-26
Added to CISA KEV
Exploited in the wild