CVE DATABASE / CVE-2015-3629
CVE-2015-3629
CVSS 7.8 · HIGH
Summary
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
CVSS 3.1 breakdown
| Base score | 7.8 (HIGH) |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | LOW |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity | HIGH |
| Availability | HIGH |
Weakness type (CWE)
Affected products
Docker libcontainerOpensuse opensuse
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://lists.opensuse.org/opensuse-updates/2015-05/msg00023.html
- http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2015/May/28
- http://www.securityfocus.com/bid/74558
- https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ
Data: NIST NVD. NVD last modified 2026-05-06. Always verify against the vendor advisory before acting.