CVE-2016-5410

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-2597.htmlThird Party Advisory
http://www.firewalld.org/2016/08/firewalld-0-4-3-3-releasePatch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/08/16/3Mailing List
http://www.securityfocus.com/bid/92481Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1360135Issue Tracking, Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPM3GUQRU2KPRXDEQLAMCDQEAIARJSBT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJMYLGRVKIPJEI3VZJ4WQZT7FBQ5BKO/
https://security.gentoo.org/glsa/201701-70Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2597.htmlThird Party Advisory
http://www.firewalld.org/2016/08/firewalld-0-4-3-3-releasePatch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/08/16/3Mailing List
http://www.securityfocus.com/bid/92481Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1360135Issue Tracking, Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPM3GUQRU2KPRXDEQLAMCDQEAIARJSBT/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJMYLGRVKIPJEI3VZJ4WQZT7FBQ5BKO/
https://security.gentoo.org/glsa/201701-70Third Party Advisory

Timeline

Published: Apr 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-54119.8/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat QuickStart Cloud Installer (QCI) before 1.0 GA is created world readable and cont CVE-2016-54126.5arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allow CVE-2016-54147.5FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.CVE-2016-54167.5389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linu CVE-2016-54177.5Memory leak in the __res_vinit function in the IPv6 name server management code in libresolv in GNU C Library (aka glibc or libc6) before 2.CVE-2016-54187.5The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote atta CVE-2016-54197.5curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers CVE-2016-54207.5curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attac CVE-2016-54218.1Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified othe CVE-2016-54228.8The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user CVE-2016-54238.3PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated us CVE-2016-54247.1PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authentica