CVE-2014-9357: docker
CVSS: 10.0v2.0HighModified
AliasesDEBIAN-CVE-2014-9357CGA-3ccr-q9vp-q4cmCGA-4x2f-64vx-79jcCGA-7q46-h8ch-v5rqCGA-84v7-3pg7-3275CGA-98q7-xprr-w7gjCGA-9mv2-r4jv-m3qvCGA-9q3p-95m7-wr69CGA-9w9g-g485-r4gwCGA-f9qc-fhvp-9fvhCGA-hpwg-6x7r-j996CGA-j8pw-gx3w-j5fwCGA-jc5m-p9mf-6h36CGA-m736-5x6r-xmfrCGA-qcjq-22vm-xf3vCGA-r2fv-vj9p-x4mqCGA-wr2c-2phq-788pGHSA-997c-fj8j-rq5hGO-2022-0640
Published 16-12-2014Last modified 06-08-2024
Vulnerability summary
CVE-2014-9357 is a high (CVSS 10.0) vulnerability in docker. EPSS estimates a 6.20% chance of exploitation in the next 30 days, higher than 93.4% of scored vulnerabilities.
CVSS score
10.0/10
010
High · v2.0 (NVD)EPSS score
6.20%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 5 · Related 6Timeline
- 16-12-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.
CVSS metrics
4 scores · 4 sources · 2 versionsCritical 9.8Preferred score · OSV · Wolfi (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · GoEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
High 10.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
6.20%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 6.20% on 20-09-2026
20-09-202620-10-2026
EPSS score6.20%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard8 products
- dockerAll versions (No fix recorded)
- docker-config-mirror-gcrAll versions (No fix recorded)
- docker-dindAll versions (No fix recorded)
- docker-initAll versions (No fix recorded)
- docker-oci-entrypointAll versions (No fix recorded)
Wolfi8 products
- dockerAll versions (No fix recorded)
- docker-config-mirror-gcrAll versions (No fix recorded)
- docker-dindAll versions (No fix recorded)
- docker-initAll versions (No fix recorded)
- docker-oci-entrypointAll versions (No fix recorded)
Debian1 product
- docker.io< 1.3.3~dfsg1-1
Docker1 product
- docker1.3.2
Github.com/docker1 product
- docker< 1.3.3
5 vendors · 19 products
