Projectatomic - vulnerabilities (CVEs)

4 CVEs in 2 products, 0 in the last 30 days, newest from 2020-03-31.

Products

• Bubblewrap - 3 CVEs
• Oci-register-machine - 1 CVEs

Newest CVEs of Projectatomic

• CVE-2020-5291 - CVSS 7.8 (high), 2020-03-31: Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option…
• CVE-2019-12439 - CVSS 7.8 (high), 2019-05-29: bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to…
• CVE-2016-6349 - CVSS 3.3 (low), 2017-03-29: The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.
• CVE-2017-5226 - CVSS 10 (critical), 2017-03-29: When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into…