CVE-2015-3630: Information Exposure in Docker Engine – CVSS 7.2 · Watchpost

← All vulnerabilities

Information Exposure in Docker Engine

ÉLEVÉE 7.2CVE-2015-3630 · GHSA-8fvr-5rqf-3wwh · GO-2022-0638 · Published 18/05/2015 · updated 17/06/2026

En bref

CVE-2015-3630 est une vulnérabilité ÉLEVÉE (CVSS 7.2) touchant github.com/docker/docker, docker (docker).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.55%, plus élevée que 45.9% des vulnérabilités.
Correctif : mettre à jour vers 1.6.1 ou plus récent.

Package	Affected versions	Patched versions
github.com/docker/docker Go	`≥ 1.6.0, < 1.6.1`	`1.6.1`
docker docker	`≤ 1.6`	No fix yet

Description

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

NVD description

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

References

nvd.nist.gov/vuln/detail/CVE-2015-3630 · ADVISORY
moby/moby commit 545b440 · WEB
moby/moby · PACKAGE
groups.google.com/forum · WEB
groups.google.com/forum · WEB
lists.opensuse.org/opensuse-updates/2015-05/msg00023.html · WEB
packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html · WEB
seclists.org/fulldisclosure/2015/May/28 · WEB
web.nvd.nist.gov/view/vuln/detail · WEB
securityfocus.com/bid/74566 · WEB
lists.opensuse.org/opensuse-updates/2015-05/msg00023.html

Autres vulnérabilités de github.com/docker/docker

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free