modules:
  - module: github.com/opencontainers/runc
    versions:
      - fixed: 0.1.0
    vulnerable_at: 0.0.9
    packages:
      - package: github.com/opencontainers/runc/libcontainer/user
        symbols:
          - GetExecUser
        derived_symbols:
          - GetExecUserPath
description: |
    GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will
    improperly interpret numeric UIDs as usernames. If the method is used without
    verifying that usernames are formatted as expected, it may allow a user to
    gain unexpected privileges.
published: 2021-04-14T20:04:52Z
cves:
  - CVE-2016-3697
ghsas:
  - GHSA-q3j5-32m5-58c2
references:
  - fix: https://github.com/opencontainers/runc/pull/708
  - fix: https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091
  - web: https://github.com/docker/docker/issues/21436
  - web: http://rhn.redhat.com/errata/RHSA-2016-1034.html
  - web: http://rhn.redhat.com/errata/RHSA-2016-2634.html
  - web: https://security.gentoo.org/glsa/201612-28