CVE-2007-5496: XSS

reported via secalert:

The graphical sealert program interprets records in the setroubleshoot database as HTML when it displays them to the user. These records include arbitrary attacker-controlled values such as the names of processes and files involved in AVC denial events, and the sealert daemon fails to properly escape those values before passing them to its HTML parser. This allows an unprivileged local attacker to inject arbitrary HTML tags into the alerts displayed by the sealert browser, altering an alert's appearance or inserting arbitrary links. There is no preview bar to show a link's target URL. When a link in the alert is clicked, the program executes the following Python code, where 'arg2' is the value of the link's href attribute:

os.spawnl(os.PNOWAIT, "/usr/bin/htmlview", "htmlview", arg2)

The htmlview script executes the user's preferred web browser, which defaults to /usr/bin/firefox under RHEL 5. Since the attacker controls only one argument, it does not appear to be possible to inject arbitrary shell commands, or to cause Firefox to execute arbitrary JavaScript in chrome:/// context. However, in combination with security flaws in Firefox or any other web browser that htmlview may launch, this flaw could be used to execute arbitrary code or steal credentials.

— Red Hat