Veracode Vulnerability DatabaseVERACODE:10981Arbitrary Code Execution
3.7 Low
CVSS2
Access Vector
LOCAL
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:H/Au:N/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
9.7%
abrt is vulnerable to arbitrary code execution. The /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache tool does not sufficiently sanitize its environment variables, allowing arbitrary Python modules to be loaded and run from non-standard directories such as /tmp. A local attacker is able to execute arbitrary code by modifying the PYTHONPATH environment variable to reference a malicious Python module.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libreport | eq | 2.0.5__20.el6 | |
| abrt | eq | 2.0.4__14.el6 | |
| abrt | eq | 1.1.16__3.el6 | |
| abrt | eq | 1.1.13__4.el6 |
Related
3.7 Low
CVSS2
Access Vector
LOCAL
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:H/Au:N/C:P/I:P/A:P
0.0004 Low
EPSS
Percentile
9.7%