PT-2016-7599 · Docker+1 · Docker Engine+2

Published 2016-10-28 · Updated 2025-10-11 · CVE-2016-8867

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Docker Engine version 1.12.2

Description The issue allows malicious images to bypass user permissions and access files within the container filesystem or mounted volumes due to misconfigured capability policies.

Recommendations For Docker Engine version 1.12.2, consider disabling ambient capabilities until a proper configuration or patch is available to prevent malicious images from bypassing user permissions.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-8867

OPENSUSE-SU-2024:10532-1

OPENSUSE-SU-2025:15589-1

RHSA-2020:2653

SUSE-SU-2016:3084-1

SUSE-SU-2016_3084-1

SUSE-SU-2025:03540-1

SUSE-SU-2025:03545-1

Affected Products

Docker

Docker Engine

Suse

References · 257

• https://osv.dev/vulnerability/openSUSE-SU-2024:10532-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03545-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15589-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8867 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:03540-1 · Vendor Advisory
• https://docker.com/docker-cve-database · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:3084-1 · Vendor Advisory
• https://bugzilla.suse.com/1032287 · Note
• https://suse.com/security/cve/CVE-2021-41091 · Note
• https://bugzilla.suse.com/1037436 · Note
• https://bugzilla.suse.com/907012 · Note
• https://bugzilla.suse.com/999582 · Note
• https://bugzilla.suse.com/1122469 · Note
• https://bugzilla.suse.com/1028638 · Note