CVE-2015-5287 Red Hat Automatic Bug Reporting Tool Privilege Escalation
Local attackers can gain privileges via symlink attacks on predictable filenames in the ABRT coredump handler.
- Exploited in the wild
- Since 26 Aug 2026
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5287?
CVE-2015-5287 is a high-severity path traversal vulnerability in Oracle Linux, published on 7 Dec 2015. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.
Weakness: CWE-59
Which versions are affected by CVE-2015-5287?
It affects 7 products.
Products include Oracle Linux, Redhat Automatic Bug Reporting Tool, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server and 1 more.
How do I fix CVE-2015-5287?
Upgrade to a fixed version. US federal agencies must fix it by 9 Sep 2026.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2015-5287 being exploited?
Yes. Attackers have exploited CVE-2015-5287 in the wild since at least 26 Aug 2026.
Public exploit code: 1 Metasploit module, 4 Exploit-DB entries and 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Linux
Sources
Also known as GHSA-hf8c-7p7w-mch5.