Search for vulnerabilities
Vulnerability details: VCID-x5vq-pw6e-aaah
Vulnerability ID VCID-x5vq-pw6e-aaah
Aliases CVE-2016-2781
Summary chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.
Status Published
Exploitability 0.5
Weighted Severity 7.7
Risk 3.9
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-270 Privilege Context Switching Error
System Score Found at
cvssv3 8.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2781.json
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00068 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00086 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00086 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00086 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00086 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00086 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00086 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.00086 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
epss 0.0009 https://api.first.org/data/v1/epss?cve=CVE-2016-2781
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1312863
cvssv3.1 3.7 https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
generic_textual LOW https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
cvssv3.1 4.6 https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
ssvc Track https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
cvssv2 2.1 https://nvd.nist.gov/vuln/detail/CVE-2016-2781
cvssv3 6.5 https://nvd.nist.gov/vuln/detail/CVE-2016-2781
cvssv3.1 4.6 http://www.openwall.com/lists/oss-security/2016/02/28/2
ssvc Track http://www.openwall.com/lists/oss-security/2016/02/28/2
cvssv3.1 4.6 http://www.openwall.com/lists/oss-security/2016/02/28/3
ssvc Track http://www.openwall.com/lists/oss-security/2016/02/28/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2781.json
https://api.first.org/data/v1/epss?cve=CVE-2016-2781
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
http://www.openwall.com/lists/oss-security/2016/02/28/2
http://www.openwall.com/lists/oss-security/2016/02/28/3
1312863 https://bugzilla.redhat.com/show_bug.cgi?id=1312863
816320 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816320
cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*
CVE-2016-2781 https://nvd.nist.gov/vuln/detail/CVE-2016-2781
No exploits are available.
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2781.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:58:21Z/ Found at https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2781
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2781
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2016/02/28/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:58:21Z/ Found at http://www.openwall.com/lists/oss-security/2016/02/28/2
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Found at http://www.openwall.com/lists/oss-security/2016/02/28/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-06-09T15:58:21Z/ Found at http://www.openwall.com/lists/oss-security/2016/02/28/3
Exploit Prediction Scoring System (EPSS)
Percentile 0.05128
EPSS Score 0.00042
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.