Arbitrary File Write in Libcontainer in github.com/docker/docker
Summary
CVE-2015-3629: Arbitrary File Write in Libcontainer in github.com/docker/docker. Affects github.com/docker/docker versions >= 1.6.0, < 1.6.1. Fixed in 1.6.1. How to fix ↓
Also tracked for
- docker.io · Debian:11
The same CVE-2015-3629 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/docker/docker, which is written in Go. It is a popular open-source containerization platform that allows developers to automate the deployment and management of applications within containers. Docker provides an easy-to-use interface for creating, running, and managing containers, making it widely adopted in the software development industry.
Vulnerability Detail
The vulnerability identified in github.com/docker/docker is an Arbitrary File Write in Libcontainer. This vulnerability allows an attacker to write arbitrary files on the host system by exploiting a flaw in the Libcontainer library. By leveraging this vulnerability, an attacker can potentially overwrite critical system files, leading to unauthorized access, privilege escalation, or even a complete compromise of the host system.
How To Fix
Latest published version: v28.5.2+incompatible as of 22 Oct 2026
go get github.com/docker/docker@v28.5.2+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.1
This is the first release that contains the fix.
go get github.com/docker/docker@v1.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, it is advisable to implement strict access controls and permissions on the host system to limit the impact of potential file write attacks. Regularly monitoring and auditing file system changes can also help detect any unauthorized modifications.
Conclusion
The Arbitrary File Write vulnerability in Libcontainer poses a significant risk to systems utilizing the github.com/docker/docker package. It is crucial to update to version 1.6.1 or later to mitigate this vulnerability and ensure the security of the host system. Implementing strict access controls and monitoring file system changes can provide additional layers of protection.
See every vulnerability recorded for github.com/docker/docker →
FAQ
This vulnerability allows an attacker to write arbitrary files on the host system, potentially leading to unauthorized access, privilege escalation, or a complete compromise of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities.
At the time of this report, there is no known public exploit available for this vulnerability. However, it is crucial to update to the latest version to prevent any potential exploitation.
If updating to the latest version is not immediately feasible, it is recommended to implement strict access controls and permissions on the host system. Regularly monitoring and auditing file system changes can also help detect any unauthorized modifications.
The discovery of this vulnerability is credited to the open-source community. Further details about the discovery and disclosure process can be found in the vulnerability database.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/docker/docker.
