PT-2014-8957 · Docker+1 · Docker+1

Published 2014-12-16 · Updated 2025-10-11 · CVE-2014-9357

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Docker version 1.3.2

Description The issue allows remote attackers to execute arbitrary code with root privileges. This can be achieved via a crafted image or build in a Dockerfile, specifically when the image or build is contained in an LZMA (.xz) archive. The problem is related to the chroot used for archive extraction.

Recommendations For Docker version 1.3.2, consider restricting the use of LZMA (.xz) archives until a patch is available. As a temporary workaround, avoid using crafted images or builds in Dockerfiles that could exploit this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Authorization

Weakness Enumeration

CWE-285

CWE-264

Related Identifiers

CVE-2014-9357

GHSA-997C-FJ8J-RQ5H

GO-2022-0640

OPENSUSE-SU-2024:10532-1

OPENSUSE-SU-2025:15589-1

RHSA-2015:0623

SUSE-SU-2025:03540-1

SUSE-SU-2025:03545-1

Affected Products

Docker

Suse

References · 264

• https://osv.dev/vulnerability/openSUSE-SU-2024:10532-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9357 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03545-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15589-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9357 · Security Note
• https://osv.dev/vulnerability/GO-2022-0640 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:03540-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-3110.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9357 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9357 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-997c-fj8j-rq5h · Vendor Advisory
• https://github.com/moby/moby/blob/master/CHANGELOG.md#133-2014-12-11 · Note
• https://github.com/docker/docker/compare/aef842e7dfb534aba22c3c911de525ce9ac12b72...313a1b7620910e47d888f8b0a6a5eb06ad9c1ff2 · Note
• https://bugzilla.suse.com/1032287 · Note
• https://suse.com/security/cve/CVE-2021-41091 · Note