CVE-2016-2856: High severity ubuntu vulnerability
ptchown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check associated with file-descriptor passing, which allows local users to capture keystrokes and spoof data, and possibly gain privileges, via pts read and write operations, related to debian/sysdeps/linux.mk. NOTE: this is not considered a vulnerability in the upstream GNU C Library because the upstream documentation has a clear security recommendation against the --enable-ptchown option.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2856?
CVE-2016-2856 has a medium severity rating, indicating potential impact on system integrity.
How do I fix CVE-2016-2856?
To fix CVE-2016-2856, update the glibc package to the latest version available for your distribution.
Which systems are affected by CVE-2016-2856?
CVE-2016-2856 affects Debian Jessie and specific Ubuntu versions including 12.04 LTS, 14.04 LTS, 15.10, and 16.04 LTS.
What components are impacted by CVE-2016-2856?
The vulnerability impacts the 'pt_chown' component within the glibc package.
Can CVE-2016-2856 be exploited remotely?
CVE-2016-2856 requires local access for exploitation, making it less likely to be exploited by remote attackers.