Vulnerabilities

CVE-2015-5287 is a privilege escalation flaw in Red Hat's Automatic Bug Reporting Tool (ABRT) in which a local user with certain permissions can gain elevated privileges via a symlink attack against a file with a predictable name. Exploitation requires local access to an affected system; an attacker who triggers the flawed file-handling behavior can elevate their privileges on that machine. It affects deployments running ABRT, which ships by default with Red Hat Enterprise Linux and related distributions, including systems that may now be end-of-life or end-of-service. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-08-26, indicating exploitation has been observed in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS estimates a 5.0% probability of exploitation within 30 days (92nd percentile).

Do: Prioritize remediation per CISA BOD 26-04: inventory systems running ABRT (including EoL/EoS hosts), apply the updated abrt packages from Red Hat's security advisories, and migrate unsupported releases to a supported version. Where patching is not feasible, restrict local access to affected systems or disable/remove ABRT if it is not needed. Assess each asset's internet exposure and local user access, and triage per CISA's Forensics Triage Requirements.

CVE-2015-3246 is a race condition in Red Hat's libuser, the user-management library used by utilities that modify system accounts, that can cause corruption of the /etc/passwd file during concurrent account updates. An authenticated local user who triggers the race — typically by racing account-modification operations against one another — can desynchronize or corrupt the passwd file. Successful exploitation yields either a denial-of-service condition on the host or, in the privilege-escalation case, elevated (root-level) access by manipulating entries in /etc/passwd. Any Red Hat system shipping the vulnerable libuser library is affected, with risk concentrated on multi-user servers where untrusted local accounts exist. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-08-26, indicating it is being exploited in the wild, and EPSS assigns it an 8.8% probability of exploitation within 30 days (95th percentile); ransomware use is unknown and no public proof-of-concept is cataloged.

Do: Update libuser to the fixed packages provided in Red Hat's security advisories across all RHEL/Fedora systems, prioritizing multi-user servers and any asset with untrusted local accounts, in line with CISA BOD 26-04 requirements (apply vendor mitigations or discontinue use of the product where mitigation is unavailable). Because exploitation requires local credentials, review which systems expose local login to non-administrators and check the integrity of /etc/passwd for signs of tampering. Confirm the patched library is active after update and monitor for further KEV-driven deadlines.