Upstream information

CVE-2014-9357 at MITRE

Description

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

SUSE information

Overall state of this security issue: Does not affect SUSE products

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 10
Vector AV:N/AC:L/Au:N/C:C/I:C/A:C
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
SUSE Bugzilla entries: 909710, 909747

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Module for Containers 12
  • docker >= 1.6.2-31.2
Patchnames:
SUSE Linux Enterprise Module for Containers 12 GA docker
SUSE Linux Enterprise Module for Containers 15
  • docker >= 17.09.1_ce-4.25
  • docker-bash-completion >= 17.09.1_ce-4.25
Patchnames:
SUSE Linux Enterprise Module for Containers 15 GA docker
SUSE Linux Enterprise Server 12
  • docker >= 1.4.1-16.1
Patchnames:
SUSE-SLE-SERVER-12-2015-28
SUSE Linux Enterprise Server for SAP Applications 12
  • docker >= 1.4.1-16.1
Patchnames:
SUSE-SLE-SERVER-12-2015-28
SUSE OpenStack Cloud 6
  • docker >= 1.9.1-58.1
Patchnames:
SUSE OpenStack Cloud 6 GA docker
openSUSE Tumbleweed
  • docker >= 1.12.3-4.1
  • docker-bash-completion >= 1.12.3-4.1
  • docker-test >= 1.12.3-4.1
  • docker-zsh-completion >= 1.12.3-4.1
Patchnames:
openSUSE Tumbleweed GA docker