CVE-2016-5402

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
[UNKNOWN]	cfme	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-2839.htmlVendor Advisory
http://www.securityfocus.com/bid/94612Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5402Issue Tracking
http://rhn.redhat.com/errata/RHSA-2016-2839.htmlVendor Advisory
http://www.securityfocus.com/bid/94612Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-5402Issue Tracking

Timeline

Published: Oct 31, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-54035.5The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumpti CVE-2016-54046.5The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke CVE-2016-54059.8389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu CVE-2016-54068.8The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain priv CVE-2016-54079.8The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memo CVE-2016-54089.8Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterp CVE-2016-54097.5Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for re CVE-2016-54105.5firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPasst CVE-2016-54119.8/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and cont CVE-2016-54126.5arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allow CVE-2016-54147.5FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.CVE-2016-54167.5389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu