Code: char* problem_data_save(problem_data_t *pd)
 {
     load_abrt_conf();
 
    struct dump_dir *dd = create_dump_dir_from_problem_data(pd, g_settings_dump_location);
 
     char *problem_id = NULL;
     if (dd)
    {
        problem_id = xstrdup(dd->dd_dirname);
        dd_close(dd);
    }

    log_info("problem id: '%s'", problem_id);
    return problem_id;
}

Vulnerability Type: +Info 
CWE ID: CWE-200
Summary: The event scripts in Automatic Bug Reporting Tool (ABRT) uses world-readable permission on a copy of sosreport file in problem directories, which allows local users to obtain sensitive information from /var/log/messages via unspecified vectors.
Commit Message: make the dump directories owned by root by default

It was discovered that the abrt event scripts create a user-readable
copy of a sosreport file in abrt problem directories, and include
excerpts of /var/log/messages selected by the user-controlled process
name, leading to an information disclosure.

This issue was discovered by Florian Weimer of Red Hat Product Security.

Related: #1212868

Signed-off-by: Jakub Filak <jfilak@redhat.com>