CVE-2015-3151

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the (1) NewProblem, (2) GetInfo, (3) SetElement, or (4) DeleteElement method.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
ABRT	ABRT	before 7a47f57975be0d285a2f20758e4572dca6d9cdd3

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3151Issue Tracking, Third Party Advisory
https://github.com/abrt/abrt/commit/7a47f57975be0d285a2f20758e4572dca6d9cdd3Patch, Third Party Advisory
https://github.com/abrt/abrt/commit/c796c76341ee846cfb897ed645bac211d7d0a932Patch, Third Party Advisory
https://github.com/abrt/abrt/commit/f3c2a6af3455b2882e28570e8a04f1c2d4500d5bPatch, Third Party Advisory
https://github.com/abrt/libreport/commit/239c4f7d1f47265526b39ad70106767d00805277Patch, Third Party Advisory
https://github.com/abrt/libreport/commit/54ecf8d017580b495d6501e53ca54e453a73a364Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-3151Issue Tracking, Third Party Advisory
https://github.com/abrt/abrt/commit/7a47f57975be0d285a2f20758e4572dca6d9cdd3Patch, Third Party Advisory
https://github.com/abrt/abrt/commit/c796c76341ee846cfb897ed645bac211d7d0a932Patch, Third Party Advisory
https://github.com/abrt/abrt/commit/f3c2a6af3455b2882e28570e8a04f1c2d4500d5bPatch, Third Party Advisory
https://github.com/abrt/libreport/commit/239c4f7d1f47265526b39ad70106767d00805277Patch, Third Party Advisory
https://github.com/abrt/libreport/commit/54ecf8d017580b495d6501e53ca54e453a73a364Patch, Third Party Advisory

Timeline

Published: Jan 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-31525.9Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mea CVE-2015-31535.0The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy and destination server, which might CVE-2015-31546.1CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remo CVE-2015-31555.0Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers CVE-2015-31565.5The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/d CVE-2015-31584.0The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not prop CVE-2015-31597.8The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process env CVE-2015-31604.3XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive in CVE-2015-31614.8The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON.CVE-2015-31625.4Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated user CVE-2015-31634.3The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users CVE-2015-31643.6The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users