Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2016-4445 Details

Description

The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7 HIGHVector:CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://bugzilla.redhat.com/show_bug.cgi?id=1339183 CVEIssue Tracking
http://seclists.org/oss-sec/2016/q2/575 CVEExploitMailing ListPatchThird Party Advisory
https://github.com/fedora-selinux/setroubleshoot/commit/2d12677629ca319310f6263688bb1b7f676c01b7 CVEPatch
https://rhn.redhat.com/errata/RHSA-2016-1267.html CVEThird Party Advisory
http://www.securityfocus.com/bid/91430 CVEThird Party AdvisoryVDB Entry

see all 12 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')[email protected]

Affected Products

ProductVersions
setroubleshoot project setroubleshoot
<= 3.2.22

CPE

  • cpe:2.3:a:setroubleshoot_project:setroubleshoot:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat enterprise linux desktop
7.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat enterprise linux hpc node
7.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat enterprise linux server
7.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat enterprise linux workstation
7.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2016-4445
NVD Published Date:
Apr 11, 2017
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2016-4445 Details - Not Deferred