PT-2016-7599 · Docker+1 · Docker Engine+2

Publicado 2016-10-28 · Atualizado 2025-10-11 · CVE-2016-8867

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Docker Engine version 1.12.2

Description The issue allows malicious images to bypass user permissions and access files within the container filesystem or mounted volumes due to misconfigured capability policies.

Recommendations For Docker Engine version 1.12.2, consider disabling ambient capabilities until a proper configuration or patch is available to prevent malicious images from bypassing user permissions.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-8867

OPENSUSE-SU-2024:10532-1

OPENSUSE-SU-2025:15589-1

RHSA-2020:2653

SUSE-SU-2016:3084-1

SUSE-SU-2016_3084-1

SUSE-SU-2025:03540-1

SUSE-SU-2025:03545-1

Produtos afetados

Docker

Docker Engine

Suse

Referências · 257

• https://bugzilla.suse.com/1032287 · Nota
• https://suse.com/security/cve/CVE-2021-41091 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10532-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1037436 · Nota
• https://bugzilla.suse.com/907012 · Nota
• https://bugzilla.suse.com/999582 · Nota
• https://bugzilla.suse.com/1122469 · Nota
• https://bugzilla.suse.com/1028638 · Nota
• https://suse.com/security/cve/CVE-2024-29018 · Nota
• https://bugzilla.suse.com/1104821 · Nota
• https://bugzilla.suse.com/1182168 · Nota
• https://bugzilla.suse.com/1038493 · Nota
• https://suse.com/security/cve/CVE-2021-41089 · Nota
• https://suse.com/security/cve/CVE-2018-10892 · Nota
• https://bugzilla.suse.com/1190670 · Nota