Описание
ELSA-2015-3037: docker security update (IMPORTANT)
[1.6.1-1.0.1]
- Update source to 1.6.1 from https://github.com/docker/docker/releases/tag/v1.6.1 Symlink traversal on container respawn allows local privilege escalation (CVE-2015-3629) Insecure opening of file-descriptor 1 leading to privilege escalation (CVE-2015-3627) Read/write proc paths allow host modification & information disclosure (CVE-2015-3630) Volume mounts allow LSM profile escalation (CVE-2015-3631) AppArmor policy improvements
Обновленные пакеты
Oracle Linux 6
Oracle Linux x86_64
docker
1.6.1-1.0.1.el6
docker-devel
1.6.1-1.0.1.el6
docker-logrotate
1.6.1-1.0.1.el6
docker-pkg-devel
1.6.1-1.0.1.el6
docker-vim
1.6.1-1.0.1.el6
docker-zsh-completion
1.6.1-1.0.1.el6
Oracle Linux 7
Oracle Linux x86_64
docker
1.6.1-1.0.1.el7
docker-devel
1.6.1-1.0.1.el7
docker-logrotate
1.6.1-1.0.1.el7
docker-pkg-devel
1.6.1-1.0.1.el7
docker-vim
1.6.1-1.0.1.el7
docker-zsh-completion
1.6.1-1.0.1.el7
Связанные CVE
Связанные уязвимости
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.
