CVE-2016-5405

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat Enterprise Linux Workstation 6 through 7 allows remote attackers to obtain user passwords.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-199

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-2594.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2765.htmlVendor Advisory
http://www.securityfocus.com/bid/93884Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1358865Issue Tracking, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2594.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2765.htmlVendor Advisory
http://www.securityfocus.com/bid/93884Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1358865Issue Tracking, Vendor Advisory

Timeline

Published: Jun 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-54068.8The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain priv CVE-2016-54079.8The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memo CVE-2016-54089.8Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterp CVE-2016-54097.5Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for re CVE-2016-54105.5firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPasst CVE-2016-54119.8/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and cont CVE-2016-54126.5arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allow CVE-2016-54147.5FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.CVE-2016-54167.5389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu CVE-2016-54177.5Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.CVE-2016-54187.5The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote atta CVE-2016-54197.5curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers