Description
Cross-site scripting (XSS) vulnerability in setroubleshoot 2.0.5 allows local users to inject arbitrary web script or HTML via a crafted (1) file or (2) process name, which triggers an Access Vector Cache (AVC) log entry in a log file used during composition of HTML documents for sealert.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | setroubleshoot +1 | 2.0.5-3.el5 | RHSA-2008:0061 |
| RHEL 5 | setroubleshoot-plugins | 2.0.4-2.el5 | RHSA-2008:0061 |
Advisories 1
- RHSA-2008:0061 Red Hat Security Advisory: setroubleshoot security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 1020078 vdb-entry
- 29324 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=288271
- setroubleshoot-sealert-avc-xss(42592) vdb-entry
- 30339 third-party-advisory
- oval:org.mitre.oval:def:10455 vdb-entry signature
- RHSA-2008:0061 vendor-advisory