CVE-2016-1585

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In all versions of AppArmor mount rules are accidentally widened when compiled.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
AppArmor	apparmor	all

References

https://bugs.launchpad.net/apparmor/+bug/1597017Issue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3EThird Party Advisory
https://bugs.launchpad.net/apparmor/+bug/1597017Issue Tracking, Third Party Advisory
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3EThird Party Advisory

Timeline

Published: Apr 22, 2019
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2016

CVE-2016-15867.5A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versi CVE-2016-15877.5The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the CVE-2016-15926.1XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.d CVE-2016-15937.2Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated admi CVE-2016-15946.5Micro Focus Novell Service Desk before 7.2 allows remote authenticated users to read arbitrary attachments via a request to a LiveTime.woa U CVE-2016-15956.5LiveTime/WebObjects/LiveTime.woa/wa/DownloadAction/downloadFile in Micro Focus Novell Service Desk before 7.2 allows remote authenticated us CVE-2016-15965.4Multiple cross-site scripting (XSS) vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject CVE-2016-15978.8A logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to administrator.CVE-2016-15985.4XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into th CVE-2016-15996.1Cross-site scripting (XSS) vulnerability in NetIQ Self Service Password Reset (SSPR) 2.x and 3.x before 3.3.1 HF2 allows remote attackers to CVE-2016-16007.5The ServiceNow driver in NetIQ Identity Manager versions prior to 4.6 are susceptible to an information disclosure vulnerability.CVE-2016-16019.8yast2-users before 3.1.47, as used in SUSE Linux Enterprise 12 SP1, does not properly set empty password fields in /etc/shadow during an Aut