CVE-2015-1870

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2015-1083.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1210.html
http://www.securityfocus.com/bid/75119Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1212868Issue Tracking, Vendor Advisory
https://github.com/abrt/abrt/commit/7d023c32a565e83306cddf34c894477b7aaf33d1Patch, Third Party Advisory
https://github.com/abrt/abrt/commit/8939398b82006ba1fec4ed491339fc075f43fc7cPatch, Third Party Advisory
https://github.com/abrt/libreport/commit/c962918bc70a61a8cc647898ee8b1ff1c14a87c5Patch, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1083.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1210.html
http://www.securityfocus.com/bid/75119Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1212868Issue Tracking, Vendor Advisory
https://github.com/abrt/abrt/commit/7d023c32a565e83306cddf34c894477b7aaf33d1Patch, Third Party Advisory
https://github.com/abrt/abrt/commit/8939398b82006ba1fec4ed491339fc075f43fc7cPatch, Third Party Advisory
https://github.com/abrt/libreport/commit/c962918bc70a61a8cc647898ee8b1ff1c14a87c5Patch, Third Party Advisory

Timeline

Published: Jun 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-18726.8The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Sta CVE-2015-18746.8Cross-site request forgery (CSRF) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin before 2.8 CVE-2015-18757.5SQL injection vulnerability in a2billing/customer/iridium_threed.php in Elastix 2.5.0 and earlier allows remote attackers to execute arbitra CVE-2015-18767.5Directory traversal vulnerability in ES File Explorer 3.2.4.1.CVE-2015-18778.8The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, CVE-2015-18786.8Thales nShield Connect hardware models 500, 1500, 6000, 500+, 1500+, and 6000+ before 11.72 allows physically proximate attackers to sign ar CVE-2015-18794.3Cross-site scripting (XSS) vulnerability in the Google Doc Embedder plugin before 2.5.19 for WordPress allows remote attackers to inject arb CVE-2015-18804.3Cross-site scripting (XSS) vulnerability in the sslvpn login page in Fortinet FortiOS 5.2.x before 5.2.3 allows remote attackers to inject a CVE-2015-18814.0OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenti CVE-2015-18828.5Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to ga CVE-2015-18834.0IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated use CVE-2015-18844.0Directory traversal vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1,