CVE-2016-2781
- State
- Published
- Severity
- 4.6 Medium
- Published
- Feb 7, 2017
- Updated
- Jun 9, 2025
- Reserved
- Feb 28, 2016
Description
chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [oss-security] 20160228 Re: Re: CVE Request: util-linux runuser tty hijacking via TIOCSTI ioctlmailing-list
- [oss-security] 20160228 Re: CVE Request: util-linux runuser tty hijacking via TIOCSTI ioctl -- chrootmailing-list
- [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jarmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.