Fluid Attacks Database

Description

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	coreutils	=8.32-4 \|\| =8.32-4.1 \|\| =9.1-1 \|\| =9.10-1 \|\| =9.4-1 \|\| =9.4-2 \|\| =9.4-3 \|\| =9.4-3.1 \|\| =9.5-1 \|\| =9.6-1 \|\| =9.6-2 \|\| =9.7-1 \|\| =9.7-2 \|\| =9.7-3	-
debian 13	coreutils	>=0 <9.4-1	9.4-1
debian 14	coreutils	>=0 <9.4-1	9.4-1
debian 12	coreutils	=9.1-1 \|\| =9.10-1 \|\| =9.4-1 \|\| =9.4-2 \|\| =9.4-3 \|\| =9.4-3.1 \|\| =9.5-1 \|\| =9.6-1 \|\| =9.6-2 \|\| =9.7-1 \|\| =9.7-2 \|\| =9.7-3	-
rpm rhel6	coreutils	-	-
rpm rhel7	coreutils	-	-

Aliases

1. CVE-2016-27812. NVD-2016-27813. OSV-DEBIAN-2016-27814. OSV-2016-27815. SECURITY-TRACKER-CVE-2016-2781

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.