{"id":"CVE-2015-1331","aliases":["DEBIAN-CVE-2015-1331","DSA-3317-1","EUVD-2015-1471","GHSA-h6rp-phmv-c3rw","MGASA-2015-0304","UBUNTU-CVE-2015-1331","USN-2675-1","openSUSE-SU-2024:10416-1"],"status":"published","title":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink...","description":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.","severity":{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:C/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00459,"percentile":0.40039,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2015-07-22T14:00:00Z","modified":"2026-09-09T06:47:20Z","fixes":[{"ecosystem":"Debian:12","package":"lxc","fixed_in":["1:1.0.7-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lxc","fixed_in":["1:1.0.7-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lxc","fixed_in":["1:1.0.7-4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"lxc","fixed_in":["1.0.7-0ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.7-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.7-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.7-4"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.0.6-6+deb8u1"}]}],"versions":["1:1.0.6-6","1:1.0.6-6+deb8u1~bpo70+1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3.1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-0ubuntu0.2"}]}],"versions":["1.0.0~alpha1-0ubuntu11","1.0.0~alpha2-0ubuntu1","1.0.0~alpha2-0ubuntu3","1.0.0~alpha2-0ubuntu4","1.0.0~alpha2-0ubuntu5","1.0.0~alpha2-0ubuntu6","1.0.0~alpha3-0ubuntu1","1.0.0~alpha3-0ubuntu2","1.0.0~alpha3-0ubuntu3","1.0.0~alpha3-0ubuntu4","1.0.0~alpha3-0ubuntu5","1.0.0~alpha3-0ubuntu6","1.0.0~alpha3-0ubuntu7","1.0.0~alpha3-0ubuntu8","1.0.0~beta1-0ubuntu1","1.0.0~beta1-0ubuntu2","1.0.0~beta1-0ubuntu3","1.0.0~beta2-0ubuntu1","1.0.0~beta2-0ubuntu2","1.0.0~beta3-0ubuntu1","1.0.0~beta4-0ubuntu1","1.0.0~beta4-0ubuntu2","1.0.0~rc1-0ubuntu2","1.0.0~rc3-0ubuntu1","1.0.0~rc4-0ubuntu1","1.0.0-0ubuntu1","1.0.0-0ubuntu2","1.0.0-0ubuntu3","1.0.0-0ubuntu4","1.0.1-0ubuntu1","1.0.2-0ubuntu1","1.0.2-0ubuntu2","1.0.3-0ubuntu1","1.0.3-0ubuntu2","1.0.3-0ubuntu3","1.0.4-0ubuntu0.1","1.0.5-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-0ubuntu0.2"}]}],"versions":["1.0.0~alpha1-0ubuntu11","1.0.0~alpha2-0ubuntu1","1.0.0~alpha2-0ubuntu3","1.0.0~alpha2-0ubuntu4","1.0.0~alpha2-0ubuntu5","1.0.0~alpha2-0ubuntu6","1.0.0~alpha3-0ubuntu1","1.0.0~alpha3-0ubuntu2","1.0.0~alpha3-0ubuntu3","1.0.0~alpha3-0ubuntu4","1.0.0~alpha3-0ubuntu5","1.0.0~alpha3-0ubuntu6","1.0.0~alpha3-0ubuntu7","1.0.0~alpha3-0ubuntu8","1.0.0~beta1-0ubuntu1","1.0.0~beta1-0ubuntu2","1.0.0~beta1-0ubuntu3","1.0.0~beta2-0ubuntu1","1.0.0~beta2-0ubuntu2","1.0.0~beta3-0ubuntu1","1.0.0~beta4-0ubuntu1","1.0.0~beta4-0ubuntu2","1.0.0~rc1-0ubuntu2","1.0.0~rc3-0ubuntu1","1.0.0~rc4-0ubuntu1","1.0.0-0ubuntu1","1.0.0-0ubuntu2","1.0.0-0ubuntu3","1.0.0-0ubuntu4","1.0.1-0ubuntu1","1.0.2-0ubuntu1","1.0.2-0ubuntu2","1.0.3-0ubuntu1","1.0.3-0ubuntu2","1.0.3-0ubuntu3","1.0.4-0ubuntu0.1","1.0.5-0ubuntu0.1","1.0.6-0ubuntu0.1","1.0.7-0ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lxc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-2.1"}]}],"bundled":4}],"products":[{"vendor":"linuxcontainers","product":"lxc"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3317","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/75999","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2675-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00066.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://service.ait.ac.at/security/2015/LxcSecurityAnalysis.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/lxc/lxc/commit/72cf81f6a3404e35028567db2c99a90406e9c6e6","tags":["x_refsource_CONFIRM","x_transferred","fix"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1470842","tags":["x_refsource_CONFIRM","x_transferred","Exploit","evidence"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1331"},{"url":"https://github.com/advisories/GHSA-h6rp-phmv-c3rw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1331","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0304.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16443","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2675-1","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-1331","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2675-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1331","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1334","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1335","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8649","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1331","description":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.","status":"published","published":"2015-08-12T14:00:00Z","modified":"2024-08-06T04:40:18.356Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1471","description":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.","status":"published","published":"2015-08-12T14:00:00Z","modified":"2024-08-06T04:40:18Z","updated_at":"2026-11-03T02:22:16.145787Z"}],"ghsa":[{"id":"GHSA-h6rp-phmv-c3rw","title":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink...","description":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.","status":"published","published":"2022-05-14T00:59:49Z","modified":"2023-02-02T05:02:50Z","cwes":["CWE-59"],"updated_at":"2026-11-02T14:51:31.346473Z"}],"nvd":[{"id":"CVE-2015-1331","description":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.","status":"published","published":"2015-08-12T14:59:03.823Z","modified":"2026-06-17T00:22:12.48Z","cvss":[{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:C/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"CVE-2015-1331","description":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.","status":"published","published":"2015-08-12T14:59:03Z","modified":"2026-04-16T06:16:24.815719033Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-1331","description":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.","status":"published","published":"2015-08-12T14:59:03.823Z","modified":"2026-09-09T06:47:20.029643857Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DSA-3317-1","title":"lxc - security update","status":"published","published":"2015-07-25T00:00:00Z","modified":"2026-03-09T01:20:07.533654Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0304","title":"Updated lxc package fixes security vulnerability","description":"Roman Fiedler discovered that LXC had a directory traversal flaw when\ncreating lock files. A local attacker could exploit this flaw to create an\narbitrary file as the root user (CVE-2015-1331).\n\nRoman Fiedler discovered that LXC incorrectly trusted the container's proc\nfilesystem to set up AppArmor profile changes and SELinux domain\ntransitions. A local attacker could exploit this flaw to run programs\ninside the container that are not confined by AppArmor or SELinux\n(CVE-2015-1334).\n","status":"published","published":"2015-08-07T19:20:18Z","modified":"2026-04-16T06:23:32.461960461Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10416-1","title":"liblxc-devel-2.0.4-2.1 on GA media","description":"These are all security issues fixed in the liblxc-devel-2.0.4-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:05:17.53428Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2015-1331","description":"lxclock.c in LXC 1.1.2 and earlier allows local users to create arbitrary files via a symlink attack on /run/lock/lxc/*.","status":"published","published":"2015-07-22T14:00:00Z","modified":"2026-04-22T10:02:11.343034Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2675-1","title":"lxc vulnerabilities","description":"Roman Fiedler discovered that LXC had a directory traversal flaw when creating\nlock files. A local attacker could exploit this flaw to create an arbitrary\nfile as the root user. (CVE-2015-1331)\n\nRoman Fiedler discovered that LXC incorrectly trusted the container's proc\nfilesystem to set up AppArmor profile changes and SELinux domain transitions. A\nlocal attacker could exploit this flaw to run programs inside the container\nthat are not confined by AppArmor or SELinux. (CVE-2015-1334)\n","status":"published","published":"2015-07-22T15:01:39Z","modified":"2026-04-22T09:13:47.488988Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}