ALPINE-CVE-2019-5736

See a problem?
Please try reporting it to the source first.
Source
https://security.alpinelinux.org/vuln/CVE-2019-5736
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2019-5736
Upstream
Published
2019-02-11T19:29:00Z
Modified
2026-09-10T06:17:54Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

References

Affected packages

Alpine:v3.10
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.11
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.12
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.13
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.14
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.15
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.16
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.17
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.18
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.19
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.20
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.21
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.22
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.23
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.24
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"
Alpine:v3.9
lxc

Package

Name
lxc
Purl
pkg:apk/alpine/lxc?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.1.0-r1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2019-5736.json"