CVE-2016-6349

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command.

Metrics

CVSS 3.0 3.3/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/07/26/9Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2016/10/13/7Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92143Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1360634Issue Tracking, Third Party Advisory
https://github.com/projectatomic/oci-register-machine/pull/22Patch
http://www.openwall.com/lists/oss-security/2016/07/26/9Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2016/10/13/7Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/92143Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1360634Issue Tracking, Third Party Advisory
https://github.com/projectatomic/oci-register-machine/pull/22Patch

Timeline

Published: Mar 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-63505.5OpenBSD 5.8 and 5.9 allows local users to cause a denial of service (NULL pointer dereference and panic) via a sysctl call with a path start CVE-2016-63516.7The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows loc CVE-2016-63527.5The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and CVE-2016-63536.5Cloudera Search in CDH before 5.7.0 allows unauthorized document access because Solr Queries by document id can bypass Sentry document-level CVE-2016-63549.8Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial CVE-2016-63557.5Memory leak in Cisco IOS XR 5.1.x through 5.1.3, 5.2.x through 5.2.5, and 5.3.x through 5.3.2 on ASR 9001 devices allows remote attackers to CVE-2016-63567.5A vulnerability in the email message filtering feature of Cisco AsyncOS Software for Cisco Email Security Appliances could allow an unauthen CVE-2016-63577.5A vulnerability in the configured security policies, including drop email filtering, in Cisco AsyncOS for Cisco Email Security Appliance (ES CVE-2016-63587.5A vulnerability in local FTP to the Cisco Email Security Appliance (ESA) could allow an unauthenticated, remote attacker to cause a partial CVE-2016-63596.1Cross-site scripting (XSS) vulnerability in Cisco Transport Gateway Installation Software 4.1(4.0) on Smart Call Home Transport Gateway devi CVE-2016-63607.5A vulnerability in Advanced Malware Protection (AMP) for Cisco Email Security Appliances (ESA) and Web Security Appliances (WSA) could allow CVE-2016-63616.5The Aggregated MAC Protocol Data Unit (AMPDU) implementation on Cisco Aironet 1800, 2800, and 3800 devices with software before 8.2.121.0 an