CVE-2014-6407

Published: 12 December 2014

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

Priority

Status

Package	Release	Status
docker.io Launchpad, Ubuntu, Debian	Upstream	Released (1.3.2~dfsg1-1)




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (1.3.2~dfsg1-1)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was not-affected [1.6.2~dfsg1-1ubuntu4~14.04.1])

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6407
NVD
Launchpad
Debian

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-6407

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM