High severity · published Oct 28, 2016
CVE-2016-8867
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies
7.5
CVSS
2.8%
EPSS
No
On KEV
Description
Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Docker · Docker
1.12.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-8867
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-8867
Third Party Advisory
http://www.securityfocus.com/bid/94228
www.securitytracker.com
http://www.securitytracker.com/id/1037203
Vendor Advisory
https://www.docker.com/docker-cve-database
More from Docker
7.8
CVE-2019-15752
Docker Desktop Community Edition Privilege Escalation Vulnerability
9.8
CVE-2014-0048
An issue was found in Docker before 1.6.0
9.8
CVE-2019-14271
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that…
8.8
CVE-2020-14300
The docker packages version docker-1.13.1-108.git4ef4b30.el7 as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 (https://access.redhat.com/errata/RHBA-2020:0053)…
8.8
CVE-2020-14298
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which…