Skip to content
OpenAdvisories
High ELSA-2016-3568 1 CVE

Important: docker-engine security update (Oracle Linux 7)

Published May 20, 2016 · Updated May 20, 2016

Ecosystem: Oracle Linux

Summary

[1.10.3-1.0.3]
- CVE-2016-3697: docker: Potential privilege escalation via confusion of usernames and UIDs [orabug 23279003]

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 7 docker-engine 0:1.10.3-1.0.3.el7
Oracle Linux · 7 docker-engine-selinux 0:1.10.3-1.0.3.el7

Vulnerabilities 1

  • High 7.8
    CVE-2016-3697

    Privilege Elevation in runc

    libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

    github.com/opencontainers/runc runc Debian Go