Fedora 40 : crun (2025-166f075581)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-166f075581 advisory. Security fix for GHSA-f42g-r5jj-qh4j Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

SUSE CVE-2025-24965

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current...

CVE-2025-24965

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current...

CVE-2025-24965 .krun_config.json symlink attack creates or overwrites file on the host in crun

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current...

CVE-2025-24965 .krun_config.json symlink attack creates or overwrites file on the host in crun

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current...

crun-1.20-1.1 on GA media (moderate)

crun-1.20-1.1 on GA media Announcement ID: openSUSE-SU-2025:14763-1 Rating: moderate Cross-References: CVE-2025-24965 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the crun-1.20-1.1 package ...

Fedora 41 : crun (2025-46200d968d)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-46200d968d advisory. Security fix for GHSA-f42g-r5jj-qh4j Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

Privilege Escalation

crun is vulnerable to privilege escalation. The vulnerability exists due to a flaw was found in crun where containers were incorrectly started with non-empty default permissions...

CVE-2019-18837

An issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check whether a target is a symlink, resulting in access to files outside of the container. This occurs in libcrun/linux.c and libcrun/chrootrealpath.c...