Skip to content
Back to search

CVE-2016-3697

HIGH
7.8NVD

Summary

generated automatically from NVD data

In runC (libcontainer/user/user.go) before 0.1.0, as used in Docker before 1.11.2, a numeric UID is wrongly handled as a possible username. A local user can exploit this by placing a numeric username in a container's password file, which may let them gain privileges. NVD rates it 7.8 (HIGH, CVSS v3.1), with local attack vector, low complexity, and high impact on confidentiality, integrity and availability.

NVD description

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

Share:

EPSS · FIRST.org

0.39%probability of exploitation in the next 30 days

Higher than 32% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.

CVSS v3.1 Score

7.8
/ 10.0
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Information

Published
1 juin 2016
Updated
17 juin 2026
Status
Modified
Source
secalert@redhat.com

Affected products

docker dockerAll Docker CVEs →
Versions ≤ 1.11.1
linuxfoundation runc
Versions ≤ 0.0.9
opensuse opensuse
Versions 13.2

Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.

Weaknesses (CWE)

CWE-264

References (16)

Similar CVEs

Other vulnerabilities of type CWE-264

…

Running Docker? Know which CVEs hit your version.

Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.

Watch my DockerI already have an account