This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2014-6407 →
DEBIAN-CVE-2014-6407
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an ima...
Original description
The description as published by the source.
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
docker.io
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2~dfsg1-1"}]}]
Debian:13
docker.io
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2~dfsg1-1"}]}]
Debian:14
docker.io
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2~dfsg1-1"}]}]
References
- advisory security-tracker.debian.org