Medium severity4.6NVD Advisory· Published Feb 7, 2017· Updated Jun 17, 2026

CVE-2016-2781

Description

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GNU/Coreutils2 versions
cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*
- (no CPE)
osv-coords6 versions
pkg:apk/chainguard/coreutils pkg:apk/chainguard/coreutils-doc pkg:apk/chainguard/coreutils-legacy pkg:apk/wolfi/coreutils pkg:apk/wolfi/coreutils-doc pkg:apk/wolfi/coreutils-legacy
< 9.6-r30+ 5 more
- (no CPE)range: < 9.6-r30
- (no CPE)range: < 9.6-r30
- (no CPE)range: < 9.6-r30
- (no CPE)range: < 9.6-r30
- (no CPE)range: < 9.6-r30
- (no CPE)range: < 9.6-r30

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2016/02/28/2nvdMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2016/02/28/3nvdMailing ListThird Party Advisory
lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3Envd

News mentions

No linked articles in our index yet.

cvss	0.299
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000