CVE-2015-3630

High

Published: 18/05/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Docker Engine before version 1.6.1 uses weak permissions for several system directories, allowing local users to modify the host and obtain sensitive information.

Risk Assessment

An attacker could exploit this vulnerability to perform protocol downgrade attacks and gain access to critical system data.

Recommendation

It is recommended to update Docker Engine to version 1.6.1 or later to mitigate this vulnerability.

Other vulnerabilities in Docker Engine

CVE-2016-8867High
Docker Engine version 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.

Original NVD description (English source)

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.