NVD Vulnerability Detail

CVE-2015-3150

Summary	abrt-dbus in Automatic Bug Reporting Tool (ABRT) allows local users to delete or change the ownership of arbitrary files via the problem directory argument to the (1) ChownProblemDir, (2) DeleteElement, or (3) DeleteProblem method.
Publication Date	Jan. 15, 2020, 3:15 a.m.
Registration Date	Jan. 26, 2021, 2:49 p.m.
Last Update	Nov. 21, 2024, 11:28 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:redhat:automatic_bug_reporting_tool:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://bugzilla.redhat.com/show_bug.cgi?id=1214457	Issue Tracking Third Party Advisory
2	https://bugzilla.redhat.com/show_bug.cgi?id=1214457	Issue Tracking Third Party Advisory
3	https://github.com/abrt/abrt/commit/6e811d78e2719988ae291181f5b133af32ce62d8	Patch Third Party Advisory
4	https://github.com/abrt/abrt/commit/6e811d78e2719988ae291181f5b133af32ce62d8	Patch Third Party Advisory
5	https://github.com/abrt/abrt/commit/7814554e0827ece778ca88fd90832bd4d05520b1	Patch Third Party Advisory
6	https://github.com/abrt/abrt/commit/7814554e0827ece778ca88fd90832bd4d05520b1	Patch Third Party Advisory
7	https://github.com/abrt/abrt/commit/b7f8bd20b7fb5b72f003ae3fa647c1d75f4218b7	Patch Third Party Advisory
8	https://github.com/abrt/abrt/commit/b7f8bd20b7fb5b72f003ae3fa647c1d75f4218b7	Patch Third Party Advisory
9	https://github.com/abrt/libreport/commit/1951e7282043dfe1268d492aea056b554baedb75	Patch Third Party Advisory
10	https://github.com/abrt/libreport/commit/1951e7282043dfe1268d492aea056b554baedb75	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Automatic Bug Reporting Tool における入力確認に関する脆弱性

Title	Automatic Bug Reporting Tool における入力確認に関する脆弱性
Summary	Automatic Bug Reporting Tool (ABRT) には、入力確認に関する脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 22, 2015, midnight
Registration Date	Feb. 4, 2020, 4:17 p.m.
Last Update	Feb. 4, 2020, 4:17 p.m.

Affected System

レッドハット

自動バグ報告ツール

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-3150	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3150
National Vulnerability Database (NVD)
2	CVE-2015-3150	https://nvd.nist.gov/vuln/detail/CVE-2015-3150

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
GitHub
1	dbus: avoid race-conditions in tests for dum dir availability	https://github.com/abrt/abrt/commit/7814554e0827ece778ca88fd90832bd4d05520b1
2	dbus: process only valid sub-directories of the dump location	https://github.com/abrt/abrt/commit/6e811d78e2719988ae291181f5b133af32ce62d8
3	lib: add functions validating dump dir	https://github.com/abrt/abrt/commit/b7f8bd20b7fb5b72f003ae3fa647c1d75f4218b7
4	lib: fix races in dump directory handling code	https://github.com/abrt/libreport/commit/1951e7282043dfe1268d492aea056b554baedb75
Red Hat Bugzilla
5	Bug 1214457	https://bugzilla.redhat.com/show_bug.cgi?id=1214457

Change Log

No	Changed Details	Date of change
1	[2020年02月04日] 掲載	Feb. 4, 2020, 4:17 p.m.