Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to the process handling custom storage volumes with the security.shifted property set to true. An attacker can gain elevated privileges on the host system by creating a custom storage volume, writing a...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to the process handling custom storage volumes with the security.shifted property set to true. An attacker can gain elevated privileges on the host system by creating a custom storage volume, writing a...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to the process handling custom storage volumes with the security.shifted property set to true. An attacker can gain elevated privileges on the host system by creating a custom storage volume, writing a...

UBUNTU-CVE-2025-64507

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true...

Moderate: Red Hat Security Advisory: Insights proxy Container Image

Initial GA Release of Red Hat Insights proxy The Insights proxy Container is used by the Insights proxy product RPM and serves as an intermediary between cystomer systems in disconnected networks, air-gapped systems or systems with no outside connections and Insights. The Insights proxy routes al...

SUSE-SU-2025:21038-1 Security update for podman

This update for podman fixes the following issues: - CVE-2025-31133,CVE-2025-52565,CVE-2025-52881: Fixed various container breakouts bsc1252376: - Fixed podman & buildah with runc 1.3.2 fail with lots of warnings as rootless bsc1252543...

Improper Access Control

github.com/opencontainers/runc is vulnerable to improper access control. The vulnerability is due to insufficient validation when bind-mounting /dev/pts/$n to /dev/console after pivotroot, which allows an attacker to manipulate mount paths and gain writable access to sensitive locations,...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.12.6 security update

Red Hat Advanced Cluster Management for Kubernetes 2.12 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. Red Hat Advanced Cluster Management for Kubernetes 2.12 images Red Hat Advanced Cluster Management for Kubernetes provides...

RHEL 9 : runc (RHSA-2025:19927)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:19927 advisory. The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes:...

Falco 0.42.1

Sysdig Falco is a behavioral activity monitoring agent that is open source and comes with native support for containers. Falco lets you define highly granular rules to check for activities involving file and network activity, process execution, IPC, and much more, using a flexible syntax. Falco...

AlmaLinux 9 : runc (ALSA-2025:19927)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:19927 advisory. runc: container escape via 'masked path' abuse due to mount race conditions CVE-2025-31133 runc: container escape with malicious config due to /dev/conso...

container escape due to /dev/console mount and related races

...

runc container escape via "masked path" abuse due to mount race conditions

...

KubeVirt Arbitrary Container File Read

...

Updated opencontainers-runc packages fix security vulnerabilities

The way masked paths are implemented in runc can be exploited to cause the host system to crash or halt CVE-2025-31133 and a flaw in /dev/console bind-mounts can lead to container escape CVE-2025-52565. Also, arbitrary write gadgets and procfs write redirects could be used to engineer container...

MGASA-2025-0271 Updated opencontainers-runc packages fix security vulnerabilities

The way masked paths are implemented in runc can be exploited to cause the host system to crash or halt CVE-2025-31133 and a flaw in /dev/console bind-mounts can lead to container escape CVE-2025-52565. Also, arbitrary write gadgets and procfs write redirects could be used to engineer container...

containerd affected by a local privilege escalation via wide permissions on CRI directory

...

[SECURITY] Fedora 42 Update: singularity-ce-4.3.4-1.fc42

SingularityCE is the Community Edition of Singularity, an open source container platform designed to be simple, fast, and secure...

[SECURITY] Fedora 43 Update: singularity-ce-4.3.4-1.fc43

SingularityCE is the Community Edition of Singularity, an open source container platform designed to be simple, fast, and secure...

SUSE CVE-2025-64329

containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is...