CVE-2025-52881 runc: LSM labels can be bypassed with malicious config using dummy procfs files

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

CVE-2025-52881

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

CVE-2025-52881

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

CVE-2024-25621

containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths /var/lib/containerd,...

SUSE CVE-2025-52881

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

UBUNTU-CVE-2025-52881

runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts we have also verified thi...

Fedora 44 : docker-buildkit (2025-c1b04cbaba)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c1b04cbaba advisory. Automatic update for docker-buildkit-0.25.2-1.fc44. Changelog Wed Nov 5 2025 Bradley G Smith - 0.25.2-1 - Update to v0.25.2 - CVE-2025-58183;...

Low: runc

Issue Overview: No CVE associated with this advisory Affected Packages: runc Note: This advisory is applicable to Amazon Linux 2 - Docker Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue...

PT-2026-22403

Name of the Vulnerable Software and Affected Versions Docker Model Runner versions prior to 1.0.16 Docker Desktop versions prior to 4.61.0 when Model Runner is enabled Description Docker Model Runner is software used to manage, run, and deploy AI models using Docker. Versions prior to 1.0.16 expo...

Important Photon OS Security Update - PHSA-2025-5.0-0667

Updates of 'docker-compose' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2025-5.0-91-0667

Updates of 'docker-compose' packages of Photon OS have been released...

PT-2025-45375

Name of the Vulnerable Software and Affected Versions runc version 1.2.7 runc version 1.3.2 runc version 1.4.0-rc.2 Description runc is a CLI tool for spawning and running containers according to the OCI specification. A race condition exists that allows an attacker to trick the tool into...

[SECURITY] Fedora 43 Update: skopeo-1.20.0-5.fc43

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: cfssl, cert-manager-cmctl, chisel, kaf, falco-exporter, php-fpmexporter, whereabouts, aws-s3-controller, tofu-controller, vendir, dagdotdev, guac, portieris, ctop, kube-vip-cloud-provider, kubernetes-dashboard-metrics-scraper, manifest-tool, direnv, capslock,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: cfssl, cert-manager-cmctl, chisel, kaf, falco-exporter, php-fpmexporter, whereabouts, aws-s3-controller, tofu-controller, vendir, dagdotdev, guac, portieris, ctop, kube-vip-cloud-provider, kubernetes-dashboard-metrics-scraper, manifest-tool, direnv, capslock,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, php-fpmexporter, kube-logging-operator, whereabouts, dagdotdev, kubernetes-dashboard-metrics-scraper, capslock, trivy, azure-ipam, rancher-telemetry, spqr, bank-vaults, argo-rollouts, fulcio, restic, nfs-subdir-external-provisioner, nerdctl, timon...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: cfssl, cert-manager-cmctl, chisel, kaf, falco-exporter, php-fpmexporter, whereabouts, aws-s3-controller, tofu-controller, vendir, dagdotdev, guac, portieris, ctop, kube-vip-cloud-provider, kubernetes-dashboard-metrics-scraper, manifest-tool, direnv, capslock,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: cfssl, cert-manager-cmctl, chisel, kaf, falco-exporter, php-fpmexporter, whereabouts, aws-s3-controller, tofu-controller, vendir, dagdotdev, guac, portieris, ctop, kube-vip-cloud-provider, kubernetes-dashboard-metrics-scraper, manifest-tool, direnv, capslock,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: cfssl, cert-manager-cmctl, chisel, kaf, falco-exporter, php-fpmexporter, whereabouts, aws-s3-controller, tofu-controller, vendir, dagdotdev, guac, portieris, ctop, kube-vip-cloud-provider, kubernetes-dashboard-metrics-scraper, manifest-tool, direnv, capslock,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: cfssl, cert-manager-cmctl, chisel, kaf, falco-exporter, php-fpmexporter, whereabouts, aws-s3-controller, tofu-controller, vendir, dagdotdev, guac, portieris, ctop, kube-vip-cloud-provider, kubernetes-dashboard-metrics-scraper, manifest-tool, direnv, capslock,...