CVE-2016-4445

Name of the Vulnerable Software and Affected Versions setroubleshoot versions prior to 3.2.23

Description The issue allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name. This is related to executing external commands with the commands.getstatusoutput function in the fix lookup id function in sealert.

Recommendations For versions prior to 3.2.23, update to version 3.2.23 or later to resolve the issue. As a temporary workaround, consider restricting the use of the fix lookup id function in sealert until a patch is available.