CVE-2015-5287
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
A program in ABRT creates temporary files with predictable names that attackers can exploit using symlinks to gain elevated privileges on the system.
CWE-59 symlink attack: ABRT's abrt-hook-ccpp creates temporary files in predictable locations (/var/tmp/abrt/ or /var/spool/abrt/) without proper validation. A local user with limited permissions can create a symlink with the expected filename pointing to a sensitive target, and when abrt processes the file with elevated privileges, the attacker gains unauthorized privilege escalation.