runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
[ { "events": [ { "introduced": "0" }, { "last_affected": "2.24.2-1" } ] } ]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2779.json"