CVE:CVE-2015-5273
CNNVD:CNNVD-201512-077
cpio等都是的产品。cpio是一款用于类UNIX系统的文件备份程序。Debug.js debug等都是(Debug.js)开源的产品。debug是一个以 Node.js 核心调试技术为模型的小型 JavaScript 调试实用程序。elixir-ecto ecto等都是(elixir-ecto)开源的产品。ecto是一个用于数据映射和语言集成查询的工具包。
Automatic Bug Reporting Tool 2.7.1之前版本存在后置链接漏洞。本地攻击者可通过对带有可预测名称的预创建目录中的unpacked.cpio文件实施符号链接攻击，利用该漏洞写入任意文件。
solution:Upgrade redhat automatic_bug_reporting_tool to a higher version than 2.7.0,and avoid the version (,2.7.0]; Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_hpc_node to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,and avoid the version 7.0