CVE-2015-3630: Information Exposure in Docker Engine
Summary
CVE-2015-3630: Information Exposure in Docker Engine. Affects github.com/docker/docker versions >= 1.6.0, < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2015-3630 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Docker Engine is an open-source containerization platform that allows developers to automate the deployment and management of applications within containers. It provides an efficient and lightweight alternative to traditional virtualization, enabling the isolation and portability of applications across different environments. Docker Engine is written in Go and is widely used in the software development industry.
Vulnerability Detail
The vulnerability identified as CVE-2015-3630 affects Docker Engine versions prior to 1.6.1. It stems from weak permissions set for certain directories in the host system, including /proc/asound, /proc/timer_stats, /proc/latency_stats, and /proc/fs. This vulnerability allows local users to manipulate the host system, gain access to sensitive information, and potentially carry out protocol downgrade attacks by leveraging a specially crafted image. The impact of this vulnerability is significant, as it can lead to unauthorized access, data leakage, and compromise of the host system's integrity.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
go get github.com/docker/docker@v1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to the patched version is the recommended solution.
Conclusion
The vulnerability identified as CVE-2015-3630 in Docker Engine poses a significant risk to the security and integrity of the host system. It is crucial for users to upgrade to version 1.6.1 or later to mitigate this vulnerability. Regularly updating Docker Engine installations is essential to stay protected against known vulnerabilities. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/docker/docker →
FAQ
Docker Engine is an open-source containerization platform that automates the deployment and management of applications within containers.
The vulnerability allows local users to manipulate the host system, gain access to sensitive information, and potentially carry out protocol downgrade attacks.
To fix this vulnerability, upgrade Docker Engine to version 1.6.1 or later.
There are no specific workarounds available. Upgrading to the patched version is the recommended solution.
Yes, this vulnerability can lead to unauthorized access, data leakage, and compromise of the host system's integrity.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
