Red Hat Security Advisory: docker security, bug fix, and enhancement update

Fixed packages 5

Vulnerabilities 1

• High 7.8
  CVE-2016-3697

  Privilege Elevation in runc

  libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

  github.com/opencontainers/runc runc Debian Go
  Jun 1, 2016

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1186066
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1261565
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1266307
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1268059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1272143
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1303110
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1309739
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1316651
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1319783
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1322762
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1328219
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1329423
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1329450
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1329743
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1330595
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1330622
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1331007
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1332592
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1034.json
• report
  https://access.redhat.com/security/cve/CVE-2016-3697
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-3697
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-3697