CVE-2016-5410

firewalld.py in firewalld before 0.4.3.3 allows local users to bypass authentication and modify firewall configurations via the (1) addPassthrough, (2) removePassthrough, (3) addEntry, (4) removeEntry, or (5) setEntries D-Bus API method.

• CWE-287

• http://rhn.redhat.com/errata/RHSA-2016-2597.htmlThird Party Advisory
• http://www.firewalld.org/2016/08/firewalld-0-4-3-3-releasePatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/08/16/3Mailing List
• http://www.securityfocus.com/bid/92481Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1360135Issue Tracking, Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPM3GUQRU2KPRXDEQLAMCDQEAIARJSBT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJMYLGRVKIPJEI3VZJ4WQZT7FBQ5BKO/
• https://security.gentoo.org/glsa/201701-70Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2597.htmlThird Party Advisory
• http://www.firewalld.org/2016/08/firewalld-0-4-3-3-releasePatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/08/16/3Mailing List
• http://www.securityfocus.com/bid/92481Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1360135Issue Tracking, Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPM3GUQRU2KPRXDEQLAMCDQEAIARJSBT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBJMYLGRVKIPJEI3VZJ4WQZT7FBQ5BKO/
• https://security.gentoo.org/glsa/201701-70Third Party Advisory

Published

Apr 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5404The cert_revoke command in FreeIPA does not check for the "r…
• CVE-2016-5405389 Directory Server in Red Hat Enterprise Linux Desktop 6 t…
• CVE-2016-5406The domain controller in Red Hat JBoss Enterprise Applicatio…
• CVE-2016-5407The (1) XvQueryAdaptors and (2) XvQueryEncodings functions i…
• CVE-2016-5408Stack-based buffer overflow in the munge_other_line function…
• CVE-2016-5409Red Hat OpenShift Enterprise 2 does not include the HTTPOnly…
• CVE-2016-5411/var/lib/ovirt-engine/setup/engine-DC-config.py in Red Hat Q…
• CVE-2016-5412arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel …
• CVE-2016-5413Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-5414FreeIPA 4.4.0 allows remote attackers to request an arbitrar…
• CVE-2016-5415Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-5416389 Directory Server in Red Hat Enterprise Linux Desktop 6 t…