CVE-2015-3159

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
ABRT	ABRT	before 9a4100678fea4d60ec93d35f4c5de2e9ad054f3a

References

https://bugzilla.redhat.com/show_bug.cgi?id=1216962Issue Tracking, Third Party Advisory
https://github.com/abrt/abrt/commit/9943a77bca37a0829ccd3784d1dfab37f8c24e7bPatch, Third Party Advisory
https://github.com/abrt/abrt/commit/9a4100678fea4d60ec93d35f4c5de2e9ad054f3aPatch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1216962Issue Tracking, Third Party Advisory
https://github.com/abrt/abrt/commit/9943a77bca37a0829ccd3784d1dfab37f8c24e7bPatch, Third Party Advisory
https://github.com/abrt/abrt/commit/9a4100678fea4d60ec93d35f4c5de2e9ad054f3aPatch, Third Party Advisory

Timeline

Published: Jan 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-31604.3XML external entity (XXE) vulnerability in bkr/server/jobs.py in Beaker before 20.1 allows remote authenticated users to obtain sensitive in CVE-2015-31614.8The search bar code in bkr/server/widgets.py in Beaker before 20.1 does not escape </script> tags in string literals when producing JSON.CVE-2015-31625.4Cross-site scripting (XSS) vulnerability in the edit comment dialog in bkr/server/widgets.py in Beaker 20.1 allows remote authenticated user CVE-2015-31634.3The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users CVE-2015-31643.6The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users CVE-2015-31654.3Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 CVE-2015-31669.8The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.CVE-2015-31677.5contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses diff CVE-2015-31696.1Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.CVE-2015-31705.5selinux-policy when sysctl fs.protected_hardlinks are set to 0 allows local users to cause a denial of service (SSH login prevention) by cre CVE-2015-31715.5sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive CVE-2015-31725.4EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.