CVE-2016-3697
- State
- Published
- Severity
- Not scored
- Published
- Jun 1, 2016
- Updated
- Aug 6, 2024
- Reserved
- Mar 30, 2016
Description
libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- RHSA-2016:1034vendor-advisory
- https://github.com/opencontainers/runc/releases/tag/v0.1.0
- openSUSE-SU-2016:1417vendor-advisory
- https://github.com/docker/docker/issues/21436
- https://github.com/opencontainers/runc/pull/708
- RHSA-2016:2634vendor-advisory
- https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091
- GLSA-201612-28vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.