CVE-2016-4989

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/oss-sec/2016/q2/574Mailing List, Third Party Advisory
http://securitytracker.com/id/1036144Patch, Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1293Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1346461Issue Tracking
https://github.com/fedora-selinux/setroubleshoot/commit/dda55aa50db95a25f0d919c3a0d5871827cdc40fPatch
https://github.com/fedora-selinux/setroubleshoot/commit/e69378d7e82a503534d29c5939fa219341e8f2adPatch
https://rhn.redhat.com/errata/RHSA-2016-1267.htmlThird Party Advisory
http://seclists.org/oss-sec/2016/q2/574Mailing List, Third Party Advisory
http://securitytracker.com/id/1036144Patch, Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:1293Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1346461Issue Tracking
https://github.com/fedora-selinux/setroubleshoot/commit/dda55aa50db95a25f0d919c3a0d5871827cdc40fPatch
https://github.com/fedora-selinux/setroubleshoot/commit/e69378d7e82a503534d29c5939fa219341e8f2adPatch
https://rhn.redhat.com/errata/RHSA-2016-1267.htmlThird Party Advisory

Timeline

Published: Apr 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-49919.8Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does CVE-2016-49927.5389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu CVE-2016-49936.1CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.CVE-2016-49947.8Use-after-free vulnerability in the xcf_load_image function in app/xcf/xcf-load.c in GIMP allows remote attackers to cause a denial of servi CVE-2016-49955.3Foreman before 1.11.4 and 1.12.x before 1.12.1 does not properly restrict access to preview provisioning templates, which allows remote auth CVE-2016-49967.0discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in t CVE-2016-49977.8The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 CVE-2016-49987.1The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a den CVE-2016-49999.8SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in CVE-2016-50005.5The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an CVE-2016-50015.5This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of H CVE-2016-50027.8XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attack