CVE-2015-1870

The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.

• CWE-200

• http://rhn.redhat.com/errata/RHSA-2015-1083.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1210.html
• http://www.securityfocus.com/bid/75119Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1212868Issue Tracking, Vendor Advisory
• https://github.com/abrt/abrt/commit/7d023c32a565e83306cddf34c894477b7aaf33d1Patch, Third Party Advisory
• https://github.com/abrt/abrt/commit/8939398b82006ba1fec4ed491339fc075f43fc7cPatch, Third Party Advisory
• https://github.com/abrt/libreport/commit/c962918bc70a61a8cc647898ee8b1ff1c14a87c5Patch, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1083.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1210.html
• http://www.securityfocus.com/bid/75119Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1212868Issue Tracking, Vendor Advisory
• https://github.com/abrt/abrt/commit/7d023c32a565e83306cddf34c894477b7aaf33d1Patch, Third Party Advisory
• https://github.com/abrt/abrt/commit/8939398b82006ba1fec4ed491339fc075f43fc7cPatch, Third Party Advisory
• https://github.com/abrt/libreport/commit/c962918bc70a61a8cc647898ee8b1ff1c14a87c5Patch, Third Party Advisory

Published

Jun 26, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1864Multiple cross-site scripting (XSS) vulnerabilities in the a…
• CVE-2015-1865fts.c in coreutils 8.4 allows local users to delete arbitrar…5.1
• CVE-2015-1866Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x …
• CVE-2015-1867Pacemaker before 1.1.13 does not properly evaluate added nod…
• CVE-2015-1868The label decompression functionality in PowerDNS Recursor 3…
• CVE-2015-1869The default event handling scripts in Automatic Bug Reportin…7.8
• CVE-2015-1871Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-1872The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in…
• CVE-2015-1874Cross-site request forgery (CSRF) vulnerability in the Conta…
• CVE-2015-1875SQL injection vulnerability in a2billing/customer/iridium_th…
• CVE-2015-1876Directory traversal vulnerability in ES File Explorer 3.2.4.…
• CVE-2015-1877The open_generic_xdg_mime function in xdg-open in xdg-utils …8.8