CVE-2016-4445: redhat enterprise_linux_desktop Command Injection
Vulnerability summary
CVE-2016-4445 is a high (CVSS 7.0) Command Injection vulnerability in redhat enterprise_linux_desktop. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 11-04-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name, related to executing external commands with the commands.getstatusoutput function.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.47% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- enterprise_linux_desktop7.0
- enterprise_linux_hpc_node7.0
- enterprise_linux_server7.0
- enterprise_linux_workstation7.0
- setroubleshoot< 0:3.2.24-1.1.el7
Setroubleshoot_project1 product
- setroubleshoot≤ 3.2.22
2 vendors · 8 products
References
12 links- github.com/fedora-selinux/setroubleshoot/commit/2d12677629ca319310f6263688bb1b7f676c01b7X Refsource CONFIRMPatch
