A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user can craft a payload that injects shell metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and ultimately gain full root privileges.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0192 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2025-12744:
    A flaw was found in the ABRT daemons handling of user-supplied mount information.ABRT copies up to 12     characters from an untrusted input and places them directly into a shell command (docker inspect %s)     without proper validation. An unprivileged local user can craft a payload that injects shell     metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and     ultimately gain full root privileges.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991235 advisory.

    A flaw was found in the ABRT daemons handling of user-supplied mount information.ABRT copies up to 12     characters from an untrusted input and places them directly into a shell command (docker inspect %s)     without proper validation. An unprivileged local user can craft a payload that injects shell     metacharacters, causing the root-running ABRT process to execute attacker-controlled commands and     ultimately gain full root privileges.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:22760 advisory.

    * abrt: Command-injection in ABRT leading to local privilege escalation (CVE-2025-12744)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23032 advisory.

    The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that     help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

    Security Fix(es):

    * abrt: Command-injection in ABRT leading to local privilege escalation (CVE-2025-12744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23031 advisory.

    The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that     help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

    Security Fix(es):

    * abrt: Command-injection in ABRT leading to local privilege escalation (CVE-2025-12744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23033 advisory.

    The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that     help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

    Security Fix(es):

    * abrt: Command-injection in ABRT leading to local privilege escalation (CVE-2025-12744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23030 advisory.

    The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that     help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

    Security Fix(es):

    * abrt: Command-injection in ABRT leading to local privilege escalation (CVE-2025-12744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ed228a4b71 advisory.

    Fix CVE-2025-12744

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ae1276a1c6 advisory.

    Fix CVE-2025-12744

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-64091db7e0 advisory.

    Fix CVE-2025-12744

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-22760 advisory.

    [2.10.9-25.0.1]
    - Replaces sosreport to sos report in sosreport-event.conf [Orabug: 38590929]
    - abrt-dump-oops-Fix-vmcore-call-trace-parsing-arm [Orabug: 34184473]
    - Disable autoreporting on Oracle Linux [Orabug: 32890748]
    - Add orabug32082455-Upstream_reference_in_python3-abrt-addon.patch [Orabug: 32082455]
    - Add bug29870394-fix-redhat-reference.patch [Orabug: 29870394]
    - Drop libreport-rhel and libreport-plugin-rhtsupport requires

    [2.10.9-25.openela.0.1]
    - Remove RHT patches

    [2.10.9-25]
    - a-a-save-container-data: validate input
    - Resolves: CVE-2025-12744

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:22760 advisory.

    The Automatic Bug Reporting Tool (ABRT) recognizes defects in applications and creates bug reports that     help maintainers fix the defects. ABRT uses a plug-in system to extend its functionality.

    Security Fix(es):

    * abrt: Command-injection in ABRT leading to local privilege escalation (CVE-2025-12744)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
278649	Alibaba Cloud Linux 3 : 0192: abrt (ALINUX3-SA-2025:0192)	Nessus	Alibaba Cloud Linux Local Security Checks	high
278593	Unity Linux 20.1060a / 20.1070a Security Update: abrt (UTSA-2025-991235)	Nessus	Unity Linux Local Security Checks	high
278127	AlmaLinux 8 : abrt (ALSA-2025:22760)	Nessus	Alma Linux Local Security Checks	high
278125	RHEL 8 : abrt (RHSA-2025:23032)	Nessus	Red Hat Local Security Checks	high
278124	RHEL 8 : abrt (RHSA-2025:23031)	Nessus	Red Hat Local Security Checks	high
278120	RHEL 8 : abrt (RHSA-2025:23033)	Nessus	Red Hat Local Security Checks	high
278082	RHEL 8 : abrt (RHSA-2025:23030)	Nessus	Red Hat Local Security Checks	high
277855	Fedora 41 : abrt (2025-ed228a4b71)	Nessus	Fedora Local Security Checks	high
277628	Fedora 43 : abrt (2025-ae1276a1c6)	Nessus	Fedora Local Security Checks	high
277624	Fedora 42 : abrt (2025-64091db7e0)	Nessus	Fedora Local Security Checks	high
277598	Oracle Linux 8 : abrt (ELSA-2025-22760)	Nessus	Oracle Linux Local Security Checks	high
277473	RHEL 8 : abrt (RHSA-2025:22760)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2025-12744

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high