CVE-2014-9357 Arbitrary Code Execution
HighCVSS 10.0
EPSS 6.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| docker github.com/docker/docker(Go) | < 1.3.3 | 1.3.3 |
| debian/docker.io(Debian:12) | < 1.3.3~dfsg1-1 | 1.3.3~dfsg1-1 |
| debian/docker.io(Debian:14) | < 1.3.3~dfsg1-1 | 1.3.3~dfsg1-1 |
| debian/docker.io(Debian:13) | < 1.3.3~dfsg1-1 | 1.3.3~dfsg1-1 |
| docker github.com/docker/docker | = 1.3.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- github.com
- groups.google.com
- web.nvd.nist.gov
- 20141212 Docker 1.3.3 - Security Advisory [11 Dec 2014] mailing-list
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-9357 vendor-advisory
- bugs.debian.org issue-tracking
- groups.google.com