Skip to main content

Lxc CVE-2015-1331

MEDIUM
Improper Link Resolution Before File Access (CWE-59)
2015-08-12 security@ubuntu.com
4.9
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
4.9 MEDIUM
AV:L/AC:L/Au:N/C:N/I:C/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Confidentiality
None
Integrity
C
Availability
None

Lifecycle Timeline

1
CVE Published
Aug 12, 2015 - 14:59 cve.org
MEDIUM 4.9

DescriptionCVE.org

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.

AnalysisAI

lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*. Rated medium severity (CVSS 4.9), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-59. lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*. Affected products include: Linuxcontainers Lxc.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Lxc

View all
CVE-2013-6441 HIGH POC
7.2 Feb 14

The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/

CVE-2026-33945 CRITICAL
9.9 Mar 26

Path traversal in Incus system container manager allows authenticated remote attackers to write arbitrary files as root

CVE-2026-33897 CRITICAL
9.9 Mar 26

Incus system container and virtual machine manager versions prior to 6.23.0 allow authenticated users with instance acce

CVE-2016-8649 CRITICAL
9.1 May 01

lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inh

CVE-2026-33898 HIGH
8.8 Mar 26

Authentication bypass in Incus webui (versions prior to 6.23.0) permits local or remote attackers to gain unauthorized a

CVE-2016-10124 HIGH
8.6 Jan 09

An issue was discovered in Linux Containers (LXC) before 2016-02-22. Rated high severity (CVSS 8.6), this vulnerability

CVE-2015-1335 HIGH
7.2 Oct 01

lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinemen

CVE-2026-33743 MEDIUM
6.5 Mar 26

Denial of service in Incus prior to version 6.23.0 allows authenticated users with storage bucket access to crash the In

CVE-2026-33542 MEDIUM
5.7 Mar 26

Incus versions prior to 6.23.0 fail to validate image fingerprints when downloading from simplestreams servers, enabling

CVE-2026-33711 MEDIUM
4.7 Mar 26

Incus versions prior to 6.23.0 allow local authenticated attackers to manipulate temporary screenshot files via predicta

CVE-2015-1334 MEDIUM
4.6 Aug 12

attach.c in LXC 1.1.2 and earlier uses the proc filesystem in a container, which allows local container users to escape

CVE-2026-39402 MEDIUM
4.3 May 05

Authorization bypass in LXC's setuid helper lxc-user-nic allows unprivileged users to delete OpenVSwitch-attached networ

Share

CVE-2015-1331 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy