CVE-2016-3096: Fedoraproject Fedora

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.

Affected products

• Fedoraproject Fedora: version 22 only; version 23 only; version 24 only
• Red Hat Ansible: up to and including 1.9.6; version 2.0 only; version 2.0.1 only

Published 2016-06-03. Last modified 2026-06-17.