Lucene search
HistoryDec 12, 2014 - 3:59 p.m.
CVE-2014-6407
cve-2014-6407
docker security
arbitrary file write
arbitrary code execution
symlink attack
hard link attack
image archive
remote code execution
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8.2 High
AI Score
Confidence
High
0.09 Low
EPSS
Percentile
94.7%
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
Affected configurations
Node
dockerdockerRange≤1.3.1
ORdockerdockerMatch1.0.0
ORdockerdockerMatch1.3.0
| CPE | Name | Operator | Version |
|---|---|---|---|
| docker:docker | docker | le | 1.3.1 |
| docker:docker | docker | eq | 1.0.0 |
| docker:docker | docker | eq | 1.3.0 |
Related
openvas
openvas
Docker < 1.3.2 Privilege Escalation Vulnerability
2021-09-08 00:00:00
Amazon Linux: Security Advisory (ALAS-2014-454)
2015-09-08 00:00:00
Fedora Update for docker-io FEDORA-2014-15779
2015-01-05 00:00:00
cbl_mariner
cbl_mariner
CVE-2014-6407 affecting package moby-buildx 0.4.1-3
2021-07-08 21:56:42
osv
osv
Arbitrary Code Execution in Docker
2022-02-15 00:41:12
github
github
Arbitrary Code Execution in Docker
2022-02-15 00:41:12
veracode
veracode
Remote Code Execution (RCE)
2017-05-03 07:48:05
prion
prion
Hardcoded credentials
2014-12-12 15:59:00
Design/Logic Flaw
2014-11-25 20:59:00
cvelist
cvelist
CVE-2014-6407
2014-12-12 15:00:00
nvd
nvd
CVE-2014-6407
2014-12-12 15:59:04
CVE-2014-3605
2014-11-25 20:59:00
ubuntucve
ubuntucve
CVE-2014-6407
2014-12-12 00:00:00
debiancve
debiancve
CVE-2014-6407
2014-12-12 15:59:04
oraclelinux
oraclelinux
docker security and bug fix update
2014-12-05 00:00:00
nessus
nessus
Fedora 21 : docker-io-1.3.2-2.fc21 (2014-15779)
2014-12-04 00:00:00
Amazon Linux AMI : docker (ALAS-2014-454)
2014-11-26 00:00:00
openSUSE Security Update : docker (openSUSE-SU-2014:1596-1)
2014-12-09 00:00:00
suse
suse
Security update for docker (important)
2014-12-08 17:07:52
cve
cve
CVE-2014-3605
2014-11-25 20:59:00
amazon
amazon
Critical: docker
2014-11-25 12:22:00
fedora
fedora
[SECURITY] Fedora 21 Update: docker-io-1.3.2-2.fc21
2014-12-03 17:16:16
[SECURITY] Fedora 20 Update: docker-io-1.4.1-6.fc20
2015-01-26 02:35:37
redhatcve
redhatcve
CVE-2014-3605
2020-02-11 05:14:18
securityvulns
securityvulns
Docker 1.3.2 - Security Advisory [24 Nov 2014]
2014-12-01 00:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
8.2 High
AI Score
Confidence
High
0.09 Low
EPSS
Percentile
94.7%
Related for CVE-2014-6407