CVE-2016-4446

The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function.

References

Affected packages

Git / github.com/fedora-selinux/setroubleshoot

Affected ranges

Type: GIT
Repo: https://github.com/fedora-selinux/setroubleshoot
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

eaccf4c0d20a27d3df5ff6de8c9dcc80f6f40718

Type: GIT
Repo: https://github.com/fedora-selinux/setroubleshoot
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

eaccf4c0d20a27d3df5ff6de8c9dcc80f6f40718

Affected versions

setroubleshoot-3.*

setroubleshoot-3.2.21

setroubleshoot-3.2.22

setroubleshoot-3.2.23

setroubleshoot-3.2.24

setroubleshoot-3.2.25

setroubleshoot-3.2.26

setroubleshoot-3.2.26.1

setroubleshoot-3.2.26.2

setroubleshoot-3.2.27

setroubleshoot-plugins-3.*

setroubleshoot-plugins-3.0.62

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "-"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "7.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4446.json"