Vulnpedia
← All CVEs

CVE-2015-5287

HIGH 7.8 KNOWN EXPLOITED PoC CATALOGUED ALL-YEARS

Published 2015-12-07 · Last modified 2026-08-27 · redhat · NVD: Analyzed

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2026-08-26. Patch or mitigate now.

Exploitation likelihood

5.0%chance of exploitation in 30 days · 92nd percentile

● In CISA KEV (2026-08-26)● Catalogued PoC◆ SSVC: exploitation active, automatable no

Impact if exploited

7.8CVSS 3.1 · HIGH · ADP

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Resource commands

searchsploit --cve CVE-2015-5287 && searchsploit -m 47421Fetch the ExploitDB PoC locally; review the code before running it.
searchsploit --cve CVE-2015-5287 && searchsploit -m 38832Fetch the ExploitDB PoC locally; review the code before running it.
searchsploit --cve CVE-2015-5287 && searchsploit -m 38835Fetch the ExploitDB PoC locally; review the code before running it.
curl -s https://vulnpedia.com/cve/CVE-2015-5287/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Redhat Oracle

Products Automatic Bug Reporting Tool Linux Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node Enterprise Linux Server Enterprise Linux Workstation

Weakness (CWE)

  • CWE-59: Improper Link Resolution Before File Access ('Link Following')

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References and research data (JSON)

Vendor product assessments

Showing 32 of 432 vendor product statements; 400 omitted. Read the full vendor advisory.

  • abrt-0:2.1.11-35.el7.src as a component of Red Hat Enterprise Linux Client (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-cli-0:2.1.11-31.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-retrace-client-0:2.1.11-35.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-debuginfo-0:2.1.11-35.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-web-0:2.1.11-31.el7.i686 as a component of Red Hat Enterprise Linux ComputeNode (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-rhel-bugzilla-0:2.1.11-31.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-addon-vmcore-0:2.1.11-35.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-debuginfo-0:2.1.11-35.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-python-0:2.1.11-35.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-debuginfo-0:2.1.11-31.el7.ppc as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-plugin-mailx-0:2.1.11-31.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-web-0:2.1.11-31.el7.i686 as a component of Red Hat Enterprise Linux Server (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=i686

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-devel-0:2.1.11-35.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-devel-0:2.1.11-31.el7.ppc as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=ppc

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-plugin-logger-0:2.1.11-31.el7.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-desktop-0:2.1.11-35.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-rhel-0:2.1.11-31.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • libreport-web-devel-0:2.1.11-31.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64

    • vendor fix: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-addon-ccpp as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-addon-ccpp

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-addon-kerneloops as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-addon-kerneloops

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-addon-python as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-addon-python

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-addon-vmcore as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-addon-vmcore

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-cli as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-cli

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-console-notification as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-console-notification

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-desktop as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-desktop

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-devel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-devel

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-gui as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-gui

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-libs as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-libs

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-python as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-python

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt-tui as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt-tui

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00
  • abrt.src as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/abrt?arch=src

    Red Hat · CVE-2015-5287 · Updated 2026-08-27T02:00:27+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

  • VulnCheck KEV · 2026-08-20T00:00:00Z

    Source guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    Source ransomware assessment: Unknown

    VulnCheck KEV · CVE-2015-5287 · Updated 2026-08-20T00:00:00Z
  • VulnCheck KEV · 2026-08-20T00:00:00ZVulnCheck KEV · CVE-2015-5287
  • VulnCheck KEV · 2026-08-26T00:00:00ZVulnCheck KEV · CVE-2015-5287
    VulnCheck KEV · CVE-2015-5287
  • VulnCheck KEV · 2026-09-08T00:00:00ZVulnCheck KEV · CVE-2015-5287

Known Affected Software Configurations

VendorProductVersion range
RedhatAutomatic Bug Reporting Tool≤ 2.7.0
OracleLinux7
RedhatEnterprise Linux6.0
RedhatEnterprise Linux7.0
RedhatEnterprise Linux Desktop7.0
RedhatEnterprise Linux Hpc Node7.0
RedhatEnterprise Linux Server7.0
RedhatEnterprise Linux Workstation7.0

All CVSS metrics

  • HIGH 7.8 v3.1 · ADP Primary
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • HIGH 7.8 v3.1 · NVD Primary
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • MEDIUM 6.9 v2.0 · NVD Primary
    AV:L/AC:M/Au:N/C:C/I:C/A:C

References

Exploit-tagged references (not proof of a PoC)

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS