A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| enterprise linux | 8 | — | |
| fedoraproject | fedora | 43 | |
| redhat | automatic bug reporting tool | — | |
| redhat | enterprise linux | 7.0 | |
| Red Hat | Red Hat Enterprise Linux 6 | — | |
| Red Hat | Red Hat Enterprise Linux 7 | all versions | |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 8 | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | all versions | |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | all versions | |
| rhel aus | 8.4 | — | |
| rhel aus | 8.6 | — | |
| rhel e4s | 8.8 | — | |
| rhel eus long life | 8.4 | — | |
| rhel eus long life | 8.6 | — | |
| rhel tus | 8.8 | — |
cpe:2.3:a:redhat:automatic_bug_reporting_tool:*:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:43:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:44:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.