What’s Vulnerable › Vulnerabilities
CVE-2016-6299
- Severity: high (CVSS 7.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2017-04-14 · updated 2026-06-17
- Weakness: CWE-264
Description
The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file.
Affected products
- Fedoraproject Fedora: 23, 24, 25
- Mock Project Scm Plugin: all versions
References
- http://www.openwall.com/lists/oss-security/2016/09/13/2
- http://www.securityfocus.com/bid/92948
- https://bugzilla.redhat.com/show_bug.cgi?id=1375490
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFC4LU6GYYEVUK6LQ2FKUGMZXRTLLL5A/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VYLMPA5VLLX67DUJ6XLJ2TIW6CX2CFL4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5PH2YGYWYUAYPHK32SGUZGZXQEBEYNK/
- http://www.openwall.com/lists/oss-security/2016/09/13/2
- http://www.securityfocus.com/bid/92948
- https://bugzilla.redhat.com/show_bug.cgi?id=1375490
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFC4LU6GYYEVUK6LQ2FKUGMZXRTLLL5A/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VYLMPA5VLLX67DUJ6XLJ2TIW6CX2CFL4/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5PH2YGYWYUAYPHK32SGUZGZXQEBEYNK/
Get alerted when CVE-2016-6299 or the next vulnerability affects your stack