CVE-2015-5287

Red Hat Automatic Bug Reporting Tool Privilege Escalation

7.8 HIGHActively exploited (CISA KEV)Public exploitEPSS 4.96%

Published7 Dec 2015
Added to CISA KEV26 Aug 2026
Remediation due9 Sept 2026

Description

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Redhat Automatic Bug Reporting Tool≤ 2.7.0

Oracle Linux7

Redhat Enterprise Linux6.0 · 7.0

Redhat Enterprise Linux Desktop7.0

Redhat Enterprise Linux Hpc Node7.0

Redhat Enterprise Linux Server7.0

Redhat Enterprise Linux Workstation7.0

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

References

http://packetstormsecurity.com/files/154592/ABRT-sosreport-Privilege-Escalation.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-2505.htmlVendor Advisory
https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1266837Exploit
https://github.com/abrt/abrt/commit/3c1b60cfa62d39e5fff5a53a5bc53dae189e740ePatch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5287Third Party AdvisoryUS Government Resource
https://www.exploit-db.com/exploits/38832/Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/12/01/1Exploit
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlThird Party Advisory
http://www.securityfocus.com/bid/78137Third Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2015-5287 being actively exploited?

Yes. CVE-2015-5287 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 26 Aug 2026.

How severe is CVE-2015-5287?

CVE-2015-5287 has a CVSS 3.1 base score of 7.8, rated high. EPSS estimates a 4.96% probability of exploitation.

Which products are affected by CVE-2015-5287?

Affected products include Redhat Automatic Bug Reporting Tool, Oracle Linux, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, and 2 more.

How do I fix CVE-2015-5287?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2015-5287 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.