Skip to content

Arbitrary Code Execution

High severity GitHub Reviewed Published Feb 15, 2022 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

gomod github.com/docker/docker (Go)

Affected versions

< 1.3.3

Patched versions

1.3.3

Description

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

References

Reviewed May 12, 2021
Published to the GitHub Advisory Database Feb 15, 2022
Last updated Jan 9, 2023

Severity

High

EPSS score

Exploit Prediction Scoring System (EPSS)

This score estimates the probability of this vulnerability being exploited within the next 30 days. Data provided by FIRST.
(86th percentile)

Weaknesses

CVE ID

CVE-2014-9357

GHSA ID

GHSA-997c-fj8j-rq5h

Source code

No known source code
Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.