The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1870
Reference (s):
- BID:75119
- URL: http://www.securityfocus.com/bid/75119
- https://bugzilla.redhat.com/show_bug.cgi?id=1212868
- https://github.com/abrt/abrt/commit/7d023c32a565e83306cddf34c894477b7aaf33d1
- https://github.com/abrt/abrt/commit/8939398b82006ba1fec4ed491339fc075f43fc7c