CVE-2016-9575

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to modify profiles to issue certificates with arbitrary naming or key usage information and subsequently use such certificates for other attacks.

Metrics

CVSS 3.0 6.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-863 CWE-285

Affected software

Vendor	Product	Versions
FreeIPA	ipa	4.2.x; 4.3.x before 4.3.3; 4.4.x before 4.4.3

References

http://rhn.redhat.com/errata/RHSA-2017-0001.htmlThird Party Advisory
http://www.securityfocus.com/bid/95068Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1395311Issue Tracking, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0001.htmlThird Party Advisory
http://www.securityfocus.com/bid/95068Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1395311Issue Tracking, Third Party Advisory

Timeline

Published: Mar 13, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-95767.8The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which CVE-2016-95778.8A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An authenticated attacker could send crafted messa CVE-2016-95787.5A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling. An attacker able to connect to the SPICE server co CVE-2016-95797.5A flaw was found in the way Ceph Object Gateway would process cross-origin HTTP requests if the CORS policy was set to allow origin on a buc CVE-2016-95808.8An integer overflow vulnerability was found in tiftoimage function in openjpeg 2.1.2, resulting in heap buffer overflow.CVE-2016-95818.8An infinite loop vulnerability in tiftoimage that results in heap buffer overflow in convert_32s_C1P1 was found in openjpeg 2.1.2.CVE-2016-95837.8An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input.CVE-2016-95849.1libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.CVE-2016-95855.3Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passe CVE-2016-95868.1curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the pr CVE-2016-95878.1Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. A CVE-2016-95885.5arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of s